Every CVE Search/ Get API key

CVE-2024-56145

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

9.3 CriticalIn KEVPublic exploitFix available

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has register_argc_argv enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable register_argc_argv to mitigate the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

97.5%Up 97.4 points since Dec 19, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.3

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has register_argc_argv enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable register_argc_argv to mitigate the issue.

Record
CVE-2024-56145
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2024-3545 9.3

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has register_argc_argv enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable register_argc_argv to mitigate the issue.

Record
EUVD-2024-3545
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2p6p-9rc9-62j9 9.3

Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

Impact

You are affected if your php.ini configuration has register_argc_argv enabled.

Patches

Update to 3.9.14, 4.13.2, or 5.5.2.

Workarounds

If you can't upgrade yet, and register_argc_argv is enabled, you can disable it to mitigate the issue.

Record
GHSA-2p6p-9rc9-62j9
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-78, CWE-94
Updated
2026-11-02
CISA KEV No score

Craft CMS Code Injection Vulnerability

Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has register_argc_argv enabled.

Record
CVE-2024-56145
Weakness
CWE-94
Updated
2026-11-02
NVD 9.3

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has register_argc_argv enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable register_argc_argv to mitigate the issue.

Record
CVE-2024-56145
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 9.3

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has register_argc_argv enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable register_argc_argv to mitigate the issue.

Record
CVE-2024-56145
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-2p6p-9rc9-62j9 9.3

Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

Impact

You are affected if your php.ini configuration has register_argc_argv enabled.

Patches

Update to 3.9.14, 4.13.2, or 5.5.2.

Workarounds

If you can't upgrade yet, and register_argc_argv is enabled, you can disable it to mitigate the issue.

Record
GHSA-2p6p-9rc9-62j9
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-78, CWE-94
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
craftcms/cms
Packagist
 5.0.0-RC1 up to 5.5.2
5.5.2
craftcms/cms
Packagist
 4.0.0-RC1 up to 4.13.2
4.13.2
craftcms/cms
Packagist
 3.0.0 up to 3.9.14
3.9.14
craftcms/cms
Packagist
 5.0.0-RC1 up to 5.5.2, plus listed versions
5.0.05.0.15.0.25.0.35.0.4
Show 45 moreShow less
5.0.55.0.65.1.05.1.15.1.105.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-beta.15.2.0-beta.25.2.0-beta.35.2.0-beta.45.2.0-beta.55.2.0-beta.65.2.15.2.105.2.25.2.35.2.45.2.4.15.2.55.2.65.2.75.2.85.2.95.3.05.3.0-beta.15.3.0-beta.25.3.0.15.3.0.25.3.0.35.3.15.3.25.3.35.3.45.3.55.3.65.4.05.4.0.1
5.5.2
craftcms/cms
Packagist
 4.0.0-RC1 up to 4.13.2, plus listed versions
4.0.04.0.0-RC24.0.0-RC34.0.0.14.0.1
Show 45 moreShow less
4.0.24.0.34.0.44.0.54.0.5.14.0.5.24.0.64.1.04.1.0.14.1.0.24.1.14.1.24.1.34.1.44.1.4.14.10.04.10.0-beta.14.10.0-beta.24.10.14.10.24.10.34.10.44.10.54.10.64.10.74.10.84.11.04.11.0.14.11.0.24.11.14.11.24.11.34.11.44.11.54.12.04.12.14.12.24.12.34.12.44.12.4.14.12.54.12.64.12.6.14.12.74.12.8
4.13.2
craftcms/cms
Packagist
 3.0.0 up to 3.9.14, plus listed versions
3.0.0.13.0.0.23.0.13.0.103.0.10.1
Show 45 moreShow less
3.0.10.23.0.10.33.0.113.0.123.0.133.0.13.13.0.13.23.0.143.0.153.0.163.0.16.13.0.173.0.17.13.0.183.0.193.0.23.0.203.0.213.0.223.0.233.0.23.13.0.243.0.253.0.263.0.26.13.0.273.0.27.13.0.283.0.293.0.33.0.3.13.0.303.0.30.13.0.30.23.0.313.0.323.0.333.0.343.0.353.0.363.0.373.0.383.0.393.0.43.0.40
3.9.14

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitCraft CMS Twig Template Injection RCE via FTP Templates Path2024-12-19
PoC in GitHubChocapikk/CVE-2024-561452024-12-20
PoC in GitHubSachinart/CVE-2024-56145-craftcms-rce2024-12-22
PoC in GitHubhmhlol/craft-cms-RCE-CVE-2024-561452025-04-06
NucleiCraft CMS - Remote Code Execution via Template Path Manipulation

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-56145 is a critical vulnerability (CVSS 9.3) in Craft Cms Cms, published December 18, 2024. CISA lists it as known to be exploited, since June 2, 2025. EUVD reports exploitation since June 2, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.5%, the 99th percentile. Fixed in craftcms/cms 5.5.2.

References

This page doesn't list everything

Left out here: 514 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open