Craft CMS Remote Code Execution vulnerability
Priority CRITICAL 87CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
Why it matters now
EPSS 0.94215 99th percentileScored 2026-11-07
Fix Fixed craftcms/cms (Packagist): 4.4.15
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Craft CMS | cms | 4.0.0-RC1 – 4.4.14 | — | No fix listed | CNA |
| — | craftcms/cms (Packagist) | 4.0.0-RC1 to before 4.4.15 | 4.4.15 | Patch available | GHSA-4w8r-3xrw-v25g |
- cms VendorCraft CMS Affected 4.0.0-RC1 – 4.4.14 Fixed in — No fix listed CNA
- craftcms/cms (Packagist) Vendor— Affected 4.0.0-RC1 to before 4.4.15 Fixed in 4.4.15 Patch available GHSA-4w8r-3xrw-v25g
Remediation
- Fix · GHSA-4w8r-3xrw-v25g craftcms/cms (Packagist) Fixed in 4.4.15 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-41892
- 2026-10-03 Alias added: GHSA-4w8r-3xrw-v25g
References
Patch 5
- https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g
- https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857
- https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e
- https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1
- https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476
More Craft Cms vulnerabilities
- TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
- TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
- TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
- TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
- TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8
- TI-2020-07842 The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-41892 · CVE Program
- CVE-2023-41892 · NVD
- FIRST EPSS
- GHSA-4w8r-3xrw-v25g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences