{"id":"CVE-2023-41892","published":"2023-09-13T19:45:25Z","modified":"2025-02-13T17:09:04Z","title":"Craft CMS Remote Code Execution vulnerability","vendor":"craftcms","product":"cms","tier":"core","eol":null,"affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 4.0.0-RC1, <= 4.4.14"]}],"description":{"text":"Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.","provenance":"source","from":"CVE.org"},"summary":{"text":"Craft CMS, the content management platform from craftcms (product: cms), contains a flaw in its code-generation handling that allows remote code execution. An attacker with network access can exploit it without authentication or user interaction, with low attack complexity, to run code on affected installations.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:40Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.94215,"percentile":0.99848,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-04-15","exploitedFirstSeen":"2024-04-15","ransomware":false,"evidence":[{"url":"https://veriti.ai/blog/vulnerable-villain-when-hackers-get-hacked/","date":"2024-04-15"},{"url":"https://thorcert.notion.site/TTPs-11-Operation-An-Octopus-d875862055ca4b7b815b5e496b219671","date":"2024-07-01"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857","tags":["x_refsource_MISC"]},{"url":"https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e","tags":["x_refsource_MISC"]},{"url":"https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1","tags":["x_refsource_MISC"]},{"url":"https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476","tags":["x_refsource_MISC"]},{"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/176303/Craft-CMS-4.4.14-Remote-Code-Execution.html","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.0.0-RC1, <4.4.15"],"patched":["4.4.15"],"from":["GHSA-4w8r-3xrw-v25g"],"provenance":"source"}],"advisories":[{"id":"GHSA-4w8r-3xrw-v25g","url":"https://github.com/advisories/GHSA-4w8r-3xrw-v25g","severity":"CRITICAL","ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.0.0-RC1, <4.4.15"],"patched":["4.4.15"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2422","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2422","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":2,"earliest":"2023-10-06","earliestUrl":"https://github.com/zaenhaxor/CVE-2023-41892","repos":[{"name":"0xfalafel/CraftCMS_CVE-2023-41892","url":"https://github.com/0xfalafel/CraftCMS_CVE-2023-41892","stars":11,"created":"2023-12-26"},{"name":"diegaccio/Craft-CMS-Exploit","url":"https://github.com/diegaccio/Craft-CMS-Exploit","stars":5,"created":"2024-01-29"},{"name":"zaenhaxor/CVE-2023-41892","url":"https://github.com/zaenhaxor/CVE-2023-41892","stars":3,"created":"2023-10-06"},{"name":"acesoyeo/CVE-2023-41892","url":"https://github.com/acesoyeo/CVE-2023-41892","stars":0,"created":"2024-02-26"},{"name":"user01-1/CVE-2023-41892_poc","url":"https://github.com/user01-1/CVE-2023-41892_poc","stars":0,"created":"2025-08-21"}]},"metasploit":[{"name":"Craft CMS unauthenticated Remote Code Execution (RCE)","module":"exploit/linux/http/craftcms_unauth_rce_cve_2023_41892","type":"exploit","disclosureDate":"2023-09-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_unauth_rce_cve_2023_41892.rb"}],"nuclei":[{"id":"CVE-2023-41892","name":"CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-41892.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41892.yaml"}],"first":{"date":"2023-09-13","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_unauth_rce_cve_2023_41892.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/176303/Craft-CMS-4.4.14-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2023-09-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-41892","provenance":"source"},{"date":"2023-09-13","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-10-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_unauth_rce_cve_2023_41892.rb","provenance":"source"},{"date":"2024-04-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://veriti.ai/blog/vulnerable-villain-when-hackers-get-hacked/","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":67.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 929 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9985"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 5 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-craft-cms-cve-2023-41892","children":[{"from":"CVE-2023-41892","to":"CVE-2025-32432","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.","from":"NVD","in":"CVE-2025-32432"},{"kind":"osv-related","provenance":"source","id":"GHSA-f3gw-9ww9-jmc3","via":"reference","url":"https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g"},{"kind":"similar","provenance":"machine","score":0.42,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-33196","published":"2023-05-26","fixed":"4.4.7","kev":false},{"cve":"CVE-2023-2817","published":"2023-05-26","fixed":"4.4.12","kev":false,"link":{"from":"CVE-2023-2817","to":"CVE-2023-41892","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.4.12","toFixed":"4.4.15","daysApart":110}]}},{"cve":"CVE-2023-40035","published":"2023-08-23","fixed":"4.4.15","kev":false},{"cve":"CVE-2023-41892","published":"2023-09-13","fixed":"4.4.15","kev":false},{"cve":"CVE-2024-21622","published":"2024-01-03","fixed":"4.5.11","kev":false,"link":{"from":"CVE-2023-41892","to":"CVE-2024-21622","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.4.15","toFixed":"4.5.11","daysApart":112}]}},{"cve":"CVE-2023-36260","published":"2024-01-30","fixed":"4.6.2","kev":false},{"cve":"CVE-2024-45406","published":"2024-09-09","fixed":"5.1.2","kev":false}],"package":"Packagist:craftcms/cms"}}