Research · Dec 18, 2024 · ZeroDay Catalog
Critical Code Injection Vulnerability in Craft CMS
A code injection vulnerability has been identified in Craft CMS, affecting users with specific PHP configurations. Immediate updates are recommended to mitigate risks.
What changed
A code injection vulnerability has been discovered in Craft CMS, which could allow for remote code execution under certain conditions. This issue arises when the php.ini configuration is enabled in affected versions of the software.
Who is affected
Users of Craft CMS versions prior to 3.9.14, 4.13.2, and 5.5.2 are at risk if their PHP configuration permits the vulnerability. This includes a wide range of organizations utilizing Craft CMS for web development.
- Craft CMS users with outdated versions.
- Organizations relying on Craft for digital experiences.
- Developers who have not updated their installations.
- Web agencies managing multiple client sites using Craft CMS.
What to do
It is crucial for affected users to update their Craft CMS installations to the latest versions immediately. For those unable to perform an upgrade, disabling the relevant PHP configuration is recommended as a temporary mitigation measure.
- Upgrade to Craft CMS version 3.9.14, 4.13.2, or 5.5.2.
- Review and adjust php.ini settings to disable the vulnerability.
- Monitor for any unusual activity on affected systems.
- Stay informed about future updates and security advisories from Craft CMS.