CVE-2025-68454
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
- Record
CVE-2025-68454- CVSS 4.0
- 5.2 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-1336
- Updated
- 2026-11-02
EUVDEUVD-2026-0844
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
- Record
EUVD-2026-0844- CVSS 4.0
- 5.2 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-742x-x762-7383
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.
https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available.
It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE.
Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
References:
https://github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebe
https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
- Record
GHSA-742x-x762-7383- CVSS 4.0
- 5.2 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-1336
- Updated
- 2026-11-02
NVD
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
- Record
CVE-2025-68454- CVSS 4.0
- 5.2 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSV
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
- Record
CVE-2025-68454- CVSS 4.0
- 5.2 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSVGHSA-742x-x762-7383
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.
https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available.
It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE.
Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
References:
https://github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebe
https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
- Record
GHSA-742x-x762-7383- CVSS 4.0
- 5.2 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSVCLSA-2026-1788430341 No score
TuxCare security update for craftcms/cms (4 CVEs)
TuxCare rebuilt craftcms/cms to address 4 CVEs. Fixed in 3.9.15-p9+tuxcare.
- Record
CLSA-2026-1788430341- Updated
- 2026-11-02
OSVCLSA-2026-1793226310 No score
TuxCare security update for craftcms/cms (1 CVE)
TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 4.18.9-p2+tuxcare.
- Record
CLSA-2026-1793226310- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
craftcms/cmsPackagist |
5.0.0-RC1 to 5.8.20 | 5.8.21 |
craftcms/cmsPackagist |
4.0.0-RC1 to 4.16.16 | 4.16.17 |
craftcms/cmsTuxCare:Packagist From an advisory covering 4 CVEs |
3.9.15 up to 3.9.15-p9+tuxcare, plus listed versions 3.9.15-p1+tuxcare3.9.15-p2+tuxcare3.9.15-p3+tuxcare3.9.15-p4+tuxcare3.9.15-p5+tuxcare3.9.15-p6+tuxcare3.9.15-p7+tuxcare3.9.15-p8+tuxcare |
3.9.15-p9+tuxcare |
craftcms/cmsTuxCare:Packagist |
4.18.9 up to 4.18.9-p2+tuxcare, plus listed versions 4.18.9-p1+tuxcare |
4.18.9-p2+tuxcare |
craftcms/cmsPackagist |
5.0.0-RC1 up to 5.8.21, plus listed versions 5.0.05.0.15.0.25.0.35.0.4 Show 45 moreShow less5.0.55.0.65.1.05.1.15.1.105.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-beta.15.2.0-beta.25.2.0-beta.35.2.0-beta.45.2.0-beta.55.2.0-beta.65.2.15.2.105.2.25.2.35.2.45.2.4.15.2.55.2.65.2.75.2.85.2.95.3.05.3.0-beta.15.3.0-beta.25.3.0.15.3.0.25.3.0.35.3.15.3.25.3.35.3.45.3.55.3.65.4.05.4.0.1 |
5.8.21 |
craftcms/cmsPackagist |
4.0.0-RC1 up to 4.16.17, plus listed versions 4.0.04.0.0-RC24.0.0-RC34.0.0.14.0.1 Show 45 moreShow less4.0.24.0.34.0.44.0.54.0.5.14.0.5.24.0.64.1.04.1.0.14.1.0.24.1.14.1.24.1.34.1.44.1.4.14.10.04.10.0-beta.14.10.0-beta.24.10.14.10.24.10.34.10.44.10.54.10.64.10.74.10.84.11.04.11.0.14.11.0.24.11.14.11.24.11.34.11.44.11.54.12.04.12.14.12.24.12.34.12.44.12.4.14.12.54.12.64.12.6.14.12.74.12.8 |
4.16.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-68454 is a medium vulnerability (CVSS 5.2) in Craftcms Cms, published January 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in craftcms/cms 5.8.21.
References
github.com/craftcms/cms/security/advisories/GHSA-742x-x762-7383
nvd.nist.gov/vuln/detail/CVE-2025-68454
Left out here: 266 versions. The JSON record has them.