7.2

CVE-2025-68455

Exploit

Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Craftcms ≫ Craft Cms Version >= 4.0.0.1 < 4.16.17
Craftcms ≫ Craft Cms Version >= 5.0.1 < 5.8.21
Craftcms ≫ Craft Cms Version 4.0.0 Update -
Craftcms ≫ Craft Cms Version 4.0.0 Update rc1
Craftcms ≫ Craft Cms Version 4.0.0 Update rc2
Craftcms ≫ Craft Cms Version 4.0.0 Update rc3
Craftcms ≫ Craft Cms Version 5.0.0 Update -
Craftcms ≫ Craft Cms Version 5.0.0 Update rc1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.83% 0.538
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
security-advisories@github.com 8.6 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7
Patch
https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef
Patch
https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593
Patch
https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
Product
Release Notes
https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5
Vendor Advisory
Exploit