CVE-2025-46731: Craft CMS Remote Code Execution Vulnerability via Twig SSTI
Summary
CVE-2025-46731: Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI. Affects craftcms/cms across 2 version ranges.
>= 4.0.0-RC1, < 4.14.13
>= 5.0.0-RC1, < 5.6.15
Fixed in 4.14.13 or 5.6.15, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a flexible content management system that allows developers to create and manage websites with ease. It offers features such as custom fields, a powerful templating engine, and a user-friendly interface. However, it has been found to contain a potential remote code execution vulnerability due to server-side template injection (SSTI) in its Twig templating engine, which can be exploited if certain conditions are met.
Vulnerability Detail
Craft CMS contains a potential remote code execution vulnerability via Twig SSTI. This vulnerability arises when an attacker with administrator access can exploit the system if the 'ALLOW_ADMIN_CHANGES' setting is enabled. This could lead to unauthorized execution of arbitrary code on the server, compromising the integrity and security of the application. The vulnerability is particularly critical as it allows for high-level access to the server, which can result in data breaches or further exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0-RC1, < 4.14.134.14.13composer require craftcms/cms:4.14.13 -
>= 5.0.0-RC1, < 5.6.155.6.15composer require craftcms/cms:5.6.15
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is recommended to set the 'ALLOW_ADMIN_CHANGES' configuration to false in your production environment. This can be done by modifying the configuration file as follows: '
define('ALLOW_ADMIN_CHANGES', false);
'. This will prevent any changes from being made by administrators until the patch is applied.
Conclusion
The Craft CMS vulnerability identified as CVE-2025-46731 poses a significant risk due to its potential for remote code execution via Twig SSTI. Users are urged to update to the latest patched versions to secure their applications. Implementing the recommended workarounds can provide temporary relief until the update is completed.
See every vulnerability recorded for craftcms/cms →
FAQ
The vulnerability is a potential remote code execution flaw that can be exploited via server-side template injection in Craft CMS.
Any Craft CMS installation that has administrator access and has 'ALLOW_ADMIN_CHANGES' enabled is at risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
As a temporary measure, disable the 'ALLOW_ADMIN_CHANGES' setting in your configuration to prevent exploitation.
For more details, refer to the official advisory at https://github.com/craftcms/cms/pull/17026.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
