CVE-2025-57811
Craft Potential Remote Code Execution via Twig SSTI
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Craft Potential Remote Code Execution via Twig SSTI
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.
- Record
CVE-2025-57811- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-1336
- Updated
- 2026-11-02
EUVDEUVD-2025-25727
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.
- Record
EUVD-2025-25727- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-crcq-738g-pqvc
Craft CMS Potential Remote Code Execution via Twig SSTI
Note that users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.
https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
Note: This is a follow-up to GHSA-f3cw-hg6r-chfv
Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue.
Resources: https://github.com/craftcms/cms/pull/17612
- Record
GHSA-crcq-738g-pqvc- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-22, CWE-94, CWE-1336
- Updated
- 2026-11-02
NVD
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.
- Record
CVE-2025-57811- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSV
Craft Potential Remote Code Execution via Twig SSTI
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.
- Record
CVE-2025-57811- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSVGHSA-crcq-738g-pqvc
Craft CMS Potential Remote Code Execution via Twig SSTI
Note that users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.
https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
Note: This is a follow-up to GHSA-f3cw-hg6r-chfv
Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue.
Resources: https://github.com/craftcms/cms/pull/17612
- Record
GHSA-crcq-738g-pqvc- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-1336, CWE-22, CWE-94
- Updated
- 2026-11-02
OSVCLSA-2026-1784682948 No score
TuxCare security update for craftcms/cms (14 CVEs)
TuxCare rebuilt craftcms/cms to address 14 CVEs. Fixed in 3.9.15-p7+tuxcare.
- Record
CLSA-2026-1784682948- Updated
- 2026-11-02
OSVCLSA-2026-1791989783 No score
TuxCare security update for craftcms/cms (3 CVEs)
TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 4.18.9-p1+tuxcare.
- Record
CLSA-2026-1791989783- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
craftcms/cmsPackagist |
4.0.0-RC1 to 4.16.5 | 4.16.6 |
craftcms/cmsPackagist |
5.0.0-RC1 to 5.8.6 | 5.8.7 |
craftcms/cmsTuxCare:Packagist From an advisory covering 12 CVEs |
3.9.15 up to 3.9.15-p7+tuxcare, plus listed versions 3.9.15-p1+tuxcare3.9.15-p2+tuxcare3.9.15-p3+tuxcare3.9.15-p4+tuxcare3.9.15-p5+tuxcare3.9.15-p6+tuxcare |
3.9.15-p7+tuxcare |
craftcms/cmsTuxCare:Packagist From an advisory covering 3 CVEs |
4.18.9 up to 4.18.9-p1+tuxcare | 4.18.9-p1+tuxcare |
craftcms/cmsPackagist |
4.0.0-RC1 up to 4.16.6, plus listed versions 4.0.04.0.0-RC24.0.0-RC34.0.0.14.0.1 Show 45 moreShow less4.0.24.0.34.0.44.0.54.0.5.14.0.5.24.0.64.1.04.1.0.14.1.0.24.1.14.1.24.1.34.1.44.1.4.14.10.04.10.0-beta.14.10.0-beta.24.10.14.10.24.10.34.10.44.10.54.10.64.10.74.10.84.11.04.11.0.14.11.0.24.11.14.11.24.11.34.11.44.11.54.12.04.12.14.12.24.12.34.12.44.12.4.14.12.54.12.64.12.6.14.12.74.12.8 |
4.16.6 |
craftcms/cmsPackagist |
5.0.0-RC1 up to 5.8.7, plus listed versions 5.0.05.0.15.0.25.0.35.0.4 Show 45 moreShow less5.0.55.0.65.1.05.1.15.1.105.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-beta.15.2.0-beta.25.2.0-beta.35.2.0-beta.45.2.0-beta.55.2.0-beta.65.2.15.2.105.2.25.2.35.2.45.2.4.15.2.55.2.65.2.75.2.85.2.95.3.05.3.0-beta.15.3.0-beta.25.3.0.15.3.0.25.3.0.35.3.15.3.25.3.35.3.45.3.55.3.65.4.05.4.0.1 |
5.8.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-57811 is a medium vulnerability (CVSS 6.1) in Craftcms Cms, published August 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in craftcms/cms 4.16.6.
References
github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
nvd.nist.gov/vuln/detail/CVE-2025-57811
Left out here: 237 versions. The JSON record has them.