Craft CMS Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2024-56145, CISA KEV Listed)
Executive & SecOps Summary
SECOPS ASSESSMENTCraft CMS versions 3.x, 4.x, and 5.x running on environments where 'register_argc_argv' is enabled in php.ini
Unauthenticated remote attackers can execute arbitrary PHP code and gain full system control by sending specially crafted HTTP requests
Immediately upgrade Craft CMS to patched versions (3.9.14, 4.13.2, or 5.5.2 or higher) and disable 'register_argc_argv' in php.ini
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update your Composer configuration to upgrade Craft CMS to the latest secure release.
# Navigate to the Craft CMS project root directory
cd /var/www/craftcms
# Update Craft CMS to the latest secure version using Composer
composer update craftcms/cms --with-dependencies
# Or force specific secure versions in composer.json and run:
# "craftcms/cms": "^5.5.2" (or "^4.13.2" / "^3.9.14")
composer update2. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, disable the register_argc_argv directive in your PHP configuration to mitigate the attack vector.
# 1. Locate and disable register_argc_argv in your php.ini files
# (Adjust paths based on your OS and PHP version, e.g., /etc/php/8.2/fpm/php.ini)
sudo sed -i 's/register_argc_argv = On/register_argc_argv = Off/g' /etc/php/*/fpm/php.ini
sudo sed -i 's/register_argc_argv = On/register_argc_argv = Off/g' /etc/php/*/cli/php.ini
# 2. Restart PHP-FPM and your web server to apply changes
sudo systemctl restart php8.2-fpm
sudo systemctl restart nginx3. Log Audit & IoC Verification Commands
Verify the PHP configuration status and inspect web server access logs for potential exploitation attempts.
# Check the status of register_argc_argv in the PHP CLI environment
php -r "echo 'register_argc_argv: ' . ini_get('register_argc_argv') . PHP_EOL;"
# Scan web server access logs for suspicious CLI arguments in query strings
grep -E '\?\+|-d\+|auto_prepend_file' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/nullBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-56145) is a critical remote code execution (RCE) vulnerability in Craft CMS that manifests when combined with a specific PHP global configuration. When the register_argc_argv directive is enabled (On) in the PHP configuration file (php.ini), query string parameters passed via HTTP requests are incorrectly mapped to CLI arguments ($argv). This behavior exposes a code injection vector (CWE-94) where Craft CMS's internal entry points or libraries process these arguments without proper sanitization, leading to arbitrary PHP code execution.
2. Exploitation Mechanics & Attack Scenario
An attacker first identifies whether the target Craft CMS server has register_argc_argv enabled. Once confirmed, the attacker crafts an HTTP GET or POST request containing query strings designed to manipulate PHP CLI execution options or internal framework commands (e.g., using ?+config+... or ?-d+... patterns). This triggers the PHP parser or Craft CMS's internal console command runner to interpret the injected parameters as configuration directives or executable arguments, allowing the attacker to write web shells or establish a reverse shell under the context of the web server user (e.g., www-data).
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical), this vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation allows complete compromise of the host system, enabling attackers to exfiltrate database credentials, deface websites, deploy ransomware, or pivot laterally into the internal corporate network.
Official Vendor Advisories & References
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.
Frequently Asked SecOps Questions (CVE-2024-56145)
FAQQ1. How critical is CVE-2024-56145 and is it actively exploited in the wild?
CVE-2024-56145 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 97.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-56145?
Primary impacted vendors include craftcms across craft_cms. Scope summary: Craft CMS 3.x (before 3.9.14), 4.x (before 4.13.2), and 5.x (before 5.5.2) when php.ini has register_argc_argv enabled
Q3. What temporary mitigations or workarounds exist for CVE-2024-56145 before patching?
[Mitigation] Immediately upgrade Craft CMS to patched versions (3.9.14, 4.13.2, or 5.5.2 or higher) and disable 'register_argc_argv' in php.ini Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-56145
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (craftcms)
View Category →IBM Langflow OSS Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-9198)
[Affected Scope] IBM Langflow OSS versions 1.0.0 through 1.10.0 in default deployments
Langflow Unauthenticated Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-33017)
[Affected Scope] Langflow versions prior to 1.9.0
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-65660)
[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.