Craft CMS CVE-2025-68456

Exploitation requires an internet-reachable Craft CMS instance running an affected version (5.0.0-RC1 through 5.8.20, or 3.0.0 through 4.16.16), where the updater controllers expose updater/* actions with allowAnonymous set (ALLOW_ANONYMOUS_LIVE | ALLOW_ANONYMOUS_OFFLINE). No authentication or user interaction is needed (PR:N/UI:N). A limiting factor consistent with CVSS AT:P and the patch is that the backup action does meaningful work only when the site is in an updateable/migration-pending state and a functional backupCommand is configured; the fix short-circuits actionForceUpdate when no migrations are pending. Information disclosure is further limited by the attacker needing a separate way to access the generated backup file, whereas the resource-exhaustion (DoS) effect requires only repeated requests.

This is a genuine but moderate-priority issue. The CVSS 4.0 base score of 7.0 reflects an unauthenticated, network-reachable flaw (AV:N/AC:L/PR:N/UI:N) that the vendor rates as high confidentiality (VC:H) and high availability (VA:H) impact, but with an attack requirement present (AT:P), which corresponds to the patch logic requiring pending migrations/backup-capable state before the action does work. Multi-source signals point to real-but-limited risk rather than urgent emergency: EPSS is only 0.17% (37th percentile), there is NO CISA KEV listing, but publicly available exploit information exists via the GitHub Security Advisory (GHSA-v64r-7wg9-23pr) which documents the exact endpoint POST /admin/actions/updater/backup. The confidentiality rating (VC:H / the 'Information Disclosure' framing) is the weakest-supported claim: the changelog itself only labels this 'a DoS vulnerability,' and triggering a server-side backup does not directly hand the backup file to the attacker - disclosure would require a separate means of retrieving the generated backup. Verify the confidentiality impact with the vendor; the confirmed and reproducible impact is resource exhaustion (repeatedly forcing expensive DB dumps). Net: real priority for internet-facing Craft installs due to unauthenticated access and public exploit detail, but the low EPSS, absence of KEV, and DoS-centric fix suggest opportunistic/targeted abuse rather than mass exploitation.

An attacker sends an unauthenticated POST request to /admin/actions/updater/backup on an internet-facing Craft CMS site, which invokes the configured backupCommand and forces the server to perform a full database dump. Repeating this consumes CPU, disk I/O, and storage, degrading or knocking the site offline; if backups are written to a retrievable location, sensitive data could additionally be exposed. Exploit detail (exact endpoint and root cause) is publicly documented in the GitHub advisory, lowering the barrier to abuse.