{"id":"CVE-2025-57811","published":"2025-08-25T17:52:07Z","modified":"2025-08-25T18:05:18Z","title":"Craft Potential Remote Code Execution via Twig SSTI","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00942,"percentile":0.61002,"provenance":"source"},"cwes":[{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/pull/17612","tags":["x_refsource_MISC"]},{"url":"https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc","tags":["x_refsource_MISC"]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":12.2},{"name":"CVSS severity","points":4.27}]},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 4.0.0-RC1, < 4.16.6",">= 5.0.0-RC1, < 5.8.7"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.0.0-RC1, <4.16.6",">=5.0.0-RC1, <5.8.7"],"patched":["4.16.6","5.8.7"],"from":["GHSA-crcq-738g-pqvc"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-25727","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-craft-cms-cms-cve-2024-52293","parents":[{"from":"CVE-2024-52293","to":"CVE-2025-57811","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-crcq-738g-pqvc","via":"reference","url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv"}]}],"children":[{"from":"CVE-2025-57811","to":"CVE-2026-28695","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7).","from":"CVE.org","in":"CVE-2026-28695"}]}],"packageHistory":[{"cve":"CVE-2025-32432","published":"2025-04-25","fixed":"5.6.17","kev":true},{"cve":"CVE-2025-35939","published":"2025-05-07","fixed":"5.7.5","kev":true},{"cve":"CVE-2025-54417","published":"2025-08-09","fixed":"5.8.4","kev":false,"link":{"from":"CVE-2025-54417","to":"CVE-2025-57811","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.16.3","toFixed":"4.16.6","daysApart":16},{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"5.8.4","toFixed":"5.8.7","daysApart":16},{"kind":"similar","provenance":"machine","score":0.28,"basis":"same product + description similarity"}]}},{"cve":"CVE-2025-57811","published":"2025-08-25","fixed":"5.8.7","kev":false},{"cve":"CVE-2025-68436","published":"2026-01-05","fixed":"5.8.21","kev":false},{"cve":"CVE-2025-68437","published":"2026-01-05","fixed":"5.8.21","kev":false},{"cve":"CVE-2025-68454","published":"2026-01-05","fixed":"5.8.21","kev":false}],"package":"Packagist:craftcms/cms"}}