Firetruck

CVE-2024-56145

KEV
Updated Oct 21, 2025 · PUBLISHED
View KEV entry →

Description

Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.

Full record on cve.org →

Affected packages

PackageVendor / ProductVersion rangeStatus
cmscraftcms / cms>= 3.0.0, < 3.9.14affected
cmscraftcms / cms>= 4.0.0-RC1, < 4.13.2affected
cmscraftcms / cms>= 5.0.0-RC1, < 5.5.2affected