CVE-2024-56145criticalunder attackCWE-94

CVE-2024-56145: critical vulnerability in craftcms cms

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

Published · Updated

Follow this CVE+ Monitor cms+ Monitor Craft CMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.3epss 97%
from disclosure to weapon2 days
Published on NVDDec 18
1st PoC+2d
metasploit+1d
CISA KEV+166d
Action required by CISAfederal deadline: 2025-06-23

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Craft CMS allows attackers to run malicious code on servers where a specific PHP setting (`register_argc_argv`) is enabled. This is a critical vulnerability that can give attackers full control of the website.

Technical detail

A remote code execution vulnerability exists in Craft CMS when the PHP `register_argc_argv` configuration directive is enabled, allowing unauthenticated attackers to execute arbitrary code through an unspecified vector. The vulnerability exploits PHP's automatic population of the `$argc` and `$argv` global variables, which can be manipulated to inject malicious payloads. Affected versions: 3.x < 3.9.14, 4.x < 4.13.2, 5.x < 5.5.2.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
craftcms · cms
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — craftcms cms

In the same product, most dangerous first.

CVE-2025-32432CRITICALCraft CMS Allows Remote Code ExecutionEPSS 99.8%KEVCVE-2025-23209HIGHPotential RCE with a compromised security key in craft/cmsEPSS 21.6%KEVCVE-2023-41892CRITICALCraft CMS Remote Code Execution vulnerabilityEPSS 94.2%CVE-2026-32267HIGHCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()EPSS 9.7%CVE-2023-40035HIGHCraft CMS vulnerable to Remote Code Execution via validatePath bypassEPSS 2.3%CVE-2026-123488CRITICALCraft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search EndpointEPSS 1.9%