CVE-2025-46731
Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and ALLOW_ADMIN_CHANGES must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.
| Software | From | Fixed in |
|---|---|---|
craftcms / cms
|
4.0.0-RC1 | 4.14.13 |
|
craftcms / cms
|
5.0.0-RC1 | 5.6.15 |
| craftcms / craft_cms | 4.1.0 | 4.14.13 |
| craftcms / craft_cms | 5.1.0 | 5.6.15 |
| craftcms / craft_cms | 4.0.0-rc1 | 4.0.0-rc1.x |
| craftcms / craft_cms | 4.0.0-rc2 | 4.0.0-rc2.x |
| craftcms / craft_cms | 4.0.0-rc3 | 4.0.0-rc3.x |
| craftcms / craft_cms | 5.0.0-rc1 | 5.0.0-rc1.x |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime