CVE-2025-68454 craftcms CVE debrief

Who should care

Defenders of Craft CMS installations should assess exposure and prioritize updates. Restrict access to the Craft Control Panel and System Messages utility. Monitor for suspicious activity.

Why it matters

CVE-2025-68454 is a potential authenticated Remote Code Execution vulnerability in Craft CMS. Defenders should prioritize updates and restrict access to the Craft Control Panel and System Messages utility.

• Verify administrator access controls to the Craft Control Panel
• Restrict access to the System Messages utility
• Monitor for suspicious activity
• Update to patched versions 5.8.21 and 4.16.17

Technical summary

CVE-2025-68454 is a potential authenticated Remote Code Execution (RCE) vulnerability in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 due to Twig SSTI. This requires administrator access to the Craft Control Panel with allowAdminChanges enabled or a non-administrator account with access to the System Messages utility. The vulnerability allows for potential RCE via crafted payloads using the Twig map filter in text fields. Defenders should prioritize updating to patched versions 5.8.21 and 4.16.17, restrict access to the Craft Control Panel and System Messages utility, and monitor for suspicious activity.

Defensive priority

Defenders should prioritize updating to patched versions 5.8.21 and 4.16.17. Restrict access to the Craft Control Panel and System Messages utility. Monitor for suspicious activity.

Recommended defensive actions

• Update to patched versions 5.8.21 and 4.16.17
• Restrict access to the Craft Control Panel and System Messages utility
• Monitor for suspicious activity
• Verify administrator access controls to the Craft Control Panel
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability. The Craft CMS changelog and patch commit provide evidence of the fix. Defenders should verify administrator access controls to the Craft Control Panel, restrict access to the System Messages utility, and monitor for suspicious activity with explicit evidence limits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.