craftcms · cms
Craft CMS, the content management platform from craftcms (product: cms), contains a flaw in its code-generation handling that allows remote code execution. An attacker with network access can exploit it without authentication or user interaction, with low attack complexity, to run code on affected installations.
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
First seen exploited 7 months after disclosure. Public exploit code (Metasploit) was available the same day.
A fix was bypassed or incomplete once over 19 months. The latest fix listed for craftcms/cms is 5.1.2.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: craftcms/cms.
Upgrade to 4.15.3 or later
Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2024-56145, CVE-2025-23209, +2).
Set the version to 4.15.3 or later in your composer.json.
First fixed in 4.4.15 for CVE-2023-41892.
| If you run | Upgrade to |
|---|---|
| 4.0.0-RC1 up to 4.4.15 | 4.15.3first fix for this CVE: 4.4.15 |
“Up to” means the second version is the fix and is not affected.