CVE-2025-68455

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-68455
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 Product Release Notes
https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7 Patch
https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef Patch
https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593 Patch
https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5 Exploit Vendor Advisory
https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*
History

12 Jan 2026, 18:21

Type Values Removed Values Added
First Time Craftcms
Craftcms craft Cms
References () https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 - () https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 - Product, Release Notes
References () https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7 - () https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7 - Patch
References () https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef - () https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef - Patch
References () https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593 - () https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593 - Patch
References () https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5 - () https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5 - Exploit, Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2
CPE cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*

06 Jan 2026, 19:16

Type Values Removed Values Added
References () https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5 - () https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5 -

05 Jan 2026, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-05 22:15

Updated : 2026-01-12 18:21

NVD link : CVE-2025-68455

Mitre link : CVE-2025-68455

CVE.ORG link : CVE-2025-68455

JSON object : View

Products Affected

craftcms

  • craft_cms
CWE
CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')