What’s Vulnerable › Vulnerabilities

CVE-2025-68455: Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-05 · updated 2026-10-07
• Weakness: CWE-470

Description

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Affected products

• craftcms cms: from 4.0.0.1 before 4.16.17; from 5.0.1 before 5.8.21; 4.0.0, 4.0.0-rc1, 4.0.0-rc2, 4.0.0-rc3, 5.0.0, 5.0.0-rc1 — fixed in 4.16.17, 5.8.21

How to fix

Upgrade to a fixed version: craftcms cms 4.16.17, 5.8.21. Check the vendor advisory for mitigations.

References

• https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
• https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7
• https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef
• https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593
• https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5
• https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5

Get alerted when CVE-2025-68455 or the next vulnerability affects your stack