CVE-2025-46731

Published May 5, 2025

Last updated 2 days ago

Craft CMS

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-46731 is a potential remote code execution vulnerability found in Craft CMS. The vulnerability exists in versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16. It is related to Twig Server-Side Template Injection (SSTI). To exploit this vulnerability, an attacker must have administrator access and the `ALLOW_ADMIN_CHANGES` setting must be enabled. Users are advised to update to patched versions 4.14.13 or 5.6.15 to mitigate the issue.

Description: Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 7.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-1336

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 50

Overview

AI description

Risk scores

CVSS 4.0

Weaknesses

Social media

References