Description

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Related CPE's

a

craftcms

craft_cms

8

References

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

ProductRelease Notes

https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7

Patch

https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef

Patch

https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593

Patch

https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5

ExploitVendor Advisory

https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5

ExploitVendor Advisory

Weaknesses

[email protected]

Secondary
CWE-470

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.2 · High

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2026-01-05T22:15:52.593Z

1 week ago

Last modified

2026-01-12T18:21:12.567Z

6 hours ago