Vulnerability · Published Jan 5, 2026 · Assigned by GitHub_M

CVE-2025-68455Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

High 8.6

In plain English

A high-severity security flaw in cms from craftcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)1.0%top 38.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	craftcms/cms	5.8.21	GHSA-255j-qw47-wjh5
Packagist	craftcms/cms	4.16.17	GHSA-255j-qw47-wjh5

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	>= 5.0.0-RC1, < 5.8.21>= 4.0.0-RC1, < 4.16.17

Weakness: CWE-470 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5 x_refsource_CONFIRM
https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7 x_refsource_MISC
https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef x_refsource_MISC
https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593 x_refsource_MISC
https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 x_refsource_MISC