CVE Vulnerability Advisory Database

[Affected Scope] Craft CMS versions prior to 4.15.3 and 5.7.5

[Impact] Unauthenticated attackers can inject arbitrary PHP code into session files, potentially leading to Remote Code Execution (RCE) when chained with an independent local file inclusion vulnerability.

[Mitigation] Immediately upgrade Craft CMS to the patched versions (4.15.3, 5.7.5, or higher).

[Affected Scope] Craft CMS versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server via crafted HTTP requests, leading to complete system compromise.

[Mitigation] Immediately upgrade your Craft CMS installation to the patched versions (3.9.15, 4.14.15, or 5.6.17) depending on your major version branch.

[Affected Scope] Craft CMS 4.x (prior to 4.13.8) and 5.x (prior to 5.5.8) installations where the security key has been compromised

[Impact] Attackers can leverage the compromised security key to forge serialized payloads, leading to arbitrary Remote Code Execution (RCE) on the host server

[Mitigation] Immediately upgrade Craft CMS to version 4.13.8 or 5.5.8 (or higher) and rotate the CRAFT_SECURITY_KEY

[Affected Scope] Craft CMS versions 3.x, 4.x, and 5.x running on environments where 'register_argc_argv' is enabled in php.ini

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and gain full system control by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Craft CMS to patched versions (3.9.14, 4.13.2, or 5.5.2 or higher) and disable 'register_argc_argv' in php.ini