Research · Dec 18, 2024
Critical Code Injection Vulnerability Discovered in Craft CMS
A critical code injection vulnerability has been identified in Craft CMS, affecting users with specific php.ini configurations. Immediate updates are recommended to ensure security.
What changed
A significant code injection vulnerability has been found in Craft CMS, a popular content management system used for creating custom digital experiences. This issue arises when certain configurations in the php.ini file are enabled, leading to a potential remote code execution risk.
- The vulnerability allows attackers to execute arbitrary code remotely.
- It is crucial for users to be aware of their php.ini settings to mitigate risks.
Who is affected
Users of Craft CMS versions that have not been updated are at risk, particularly those with specific php.ini configurations enabled. This vulnerability impacts a wide range of users relying on Craft CMS for their digital projects.
- Craft CMS users running versions prior to 3.9.14, 4.13.2, or 5.5.2.
- Organizations that utilize Craft CMS for their websites and applications.
- Developers and agencies that create custom solutions using Craft CMS.
What to do
To mitigate the risks associated with this vulnerability, users are strongly advised to update their Craft CMS installations to the latest versions. For those unable to perform an update immediately, disabling certain php.ini configurations can provide a temporary safeguard.
- Update to Craft CMS version 3.9.14, 4.13.2, or 5.5.2 as soon as possible.
- If an update cannot be performed, disable any vulnerable php.ini settings.
- Regularly monitor security advisories for further updates and guidance.