CVE-2025-46731

moderate-risk
Published 2025-05-05

Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.

Do I need to act?

-
0.91% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

Craftcms

References (4)

Patch http://github.com/craftcms/cms/pull/17026
Product https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-fals...
Third Party Advisory https://github.com/craftcms/cms/security/advisories/GHSA-7c58-g782-9j38
Not Applicable https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv
41
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 3/34 · Minimal
Exposure 12/34 · Low