by Kastro
Paper/Archive/CVE-2025-68456

CVE-2025-68456

craftcms cms — Unauthenticated Craft CMS users can trigger a database backup

EPSS 0.6%public exploitCVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 46.5.465 × 209.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

Affected

ProductAffectedFixed inSource
cms>= 5.0.0-RC1, < 5.8.21–CNA
cms>= 3.0.0, < 4.16.17–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GitHub_M (CNA)7.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitgithub.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23prrefgithub.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39refgithub.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04