9.8

CVE-2024-56145: Craft CMS Code Injection Vulnerability

CVSS: 9.8v3.1CriticalKEVAnalyzed
Published 18-12-2024Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2024-56145 is a critical (CVSS 9.8) Code Injection vulnerability in Craft CMS. It is known to be exploited: CISA lists it, first on 02-06-2025. EPSS estimates a 97.41% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
97.41%
0%100%
Critical · -0.04 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits2github, metasploit

Timeline

  1. 18-12-2024
    PublishedVulnerability first disclosed.
  2. 02-06-2025
    Added to CISA KEVCraft CMS Code Injection Vulnerability
  3. 23-06-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

97.41%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.04 pp

From 97.45% on 20-09-2026

20-09-202620-10-2026
EPSS score
97.41%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
02-06-2025
Federal due date
23-06-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9 nvd.nist.gov/vuln/detail/CVE-2024-56145

Public exploits

2 found
  • githubUnverified

    Cve 2024 56145

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Craft CMS Twig Template Injection RCE via FTP Templates Path

    exploit/linux/http/craftcms_ftp_template

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Craftcms2 products
  • cms≥ 4.0.0-RC1, < 4.13.2 | ≥ 5.0.0-RC1, < 5.5.2 | ≥ 3.0.0, < 3.9.14
  • craft_cms≥ 3.0.0, < 3.9.14 | ≥ 4.0.0, < 4.13.2 | ≥ 5.0.0, < 5.5.2

1 vendor · 2 products

References

4 links