CVE-2025-68455— Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-68455
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
Source: NVD (National Vulnerability Database)
Vulnerability Description
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Craft CMS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Craft CMS是Craft CMS开源的一套内容管理系统（CMS）。 Craft CMS 5.0.0-RC1版本至5.8.20版本和4.0.0-RC1版本至4.16.16版本存在安全漏洞，该漏洞源于恶意附加行为，可能导致经过身份验证的远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-68455
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-68455
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-68455 (3)
Vendor Advisories for CVE-2025-68455 (1)
- https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5x_refsource_CONFIRM
Other References for CVE-2025-68455 (1)
Same Patch Batch · craftcms · 2026-01-05 · 5 CVEs total
| CVE-2025-68456 | Unauthenticated Craft CMS users can trigger a database backup | |
| CVE-2025-68436 | Craft CMS vulnerable to potential information disclosure via unchecked asset relocation | |
| CVE-2025-68437 | Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutati | |
| CVE-2025-68454 | Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI |
IV. Related Vulnerabilities
Same product: cms
- CVE-2026-44306
Statamic: Email enumeration via forgot password endpoint - CVE-2026-44011
Craft CMS: Potential authenticated Remote Code Execution via - CVE-2026-44012
Craft CMS: Missing Volume Permission Check in AssetsControll - CVE-2026-44010
Craft CMS: Missing Authorization in GraphQL Address Resolver - CVE-2026-7508
Bootstrap CMS Page Creation show.blade.php code injection
Same vendor: craftcms
- CVE-2026-44011
Craft CMS: Potential authenticated Remote Code Execution via - CVE-2026-44012
Craft CMS: Missing Volume Permission Check in AssetsControll - CVE-2026-44010
Craft CMS: Missing Authorization in GraphQL Address Resolver - CVE-2026-41130
Craft CMS has a host header injection leading to SSRF via re - CVE-2026-41129
Craft CMS has Server-Side Request Forgery (SSRF) with Asset
Same weakness: CWE-470
- CVE-2026-34216
CtrlPanel: Authenticated Remote Code Execution via Dynamic C - CVE-2026-8178
Remote Code Execution via Unsafe Class Loading in Amazon Red - CVE-2026-44339
PraisonAI has unsafe tool resolution in `ToolExecutionMixin. - CVE-2026-42027
Apache OpenNLP: Arbitrary Class Instantiation via Model Mani - CVE-2026-41175
Statamic: Unsafe method invocation via query value resolutio
V. Comments for CVE-2025-68455
No comments yet