Vulnerability · Published Jan 5, 2026 · Assigned by GitHub_M
CVE-2025-68456Unauthenticated Craft CMS users can trigger a database backup
High 7.0
In plain English
A high-severity resource allocation without limits in cms from craftcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/cms | 5.8.21 | GHSA-v64r-7wg9-23pr |
| Packagist | craftcms/cms | 4.16.17 | GHSA-v64r-7wg9-23pr |
Affected products (as reported)
Weakness: CWE-770, CWE-202 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P