CVE-2025-68456: craftcms cms
Vulnerability summary
CVE-2025-68456 is a critical (CVSS 9.1) vulnerability in craftcms cms. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 05-01-2026PublishedVulnerability first disclosed.
- 06-01-2026Last modifiedVulnerability information updated.
Description
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
+0.01 pp
From 0.55% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCms
Maturity: poc
Weaknesses
CWE · root cause- CWE-202Exposure of Sensitive Information Through Data QueriesWhen trying to keep information confidential, an attacker can often infer some of the information by using statistics.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
1 vendor · 2 products
References
3 links- github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23prX Refsource CONFIRMExploitVendor Advisory