CVE-2025-68456
CRITICAL
GHSA-v64r-7wg9-23pr
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
4Description
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.
Analysis
Craft CMS (5.0.0-RC1 through 5.8.20, 3.x through 4.16.16) allows unauthenticated users to trigger database backup operations, leading to resource exhaustion or information disclosure if backups are stored in accessible locations. PoC available, patches available.
Technical Context
Specific admin actions for database backup can be invoked without authentication (CWE-202). If backup files are stored in a web-accessible directory, an attacker can trigger a backup and then download it, obtaining the entire database. Even without file access, repeated backup triggering causes disk exhaustion.
Affected Products
Craft CMS 5.0.0-RC1 through 5.8.20, 3.x through 4.16.16
Remediation
Update to Craft CMS 5.8.21 or 4.16.17. Ensure database backups are stored outside the webroot. Review backup directory for unauthorized files.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today