{"id":"CVE-2025-46731","published":"2025-05-05T19:35:31Z","modified":"2025-05-05T20:03:42Z","title":"Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.3,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01518,"percentile":0.74527,"provenance":"source"},"cwes":[{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-7c58-g782-9j38","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv","tags":["x_refsource_MISC"]},{"url":"https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production","tags":["x_refsource_MISC"]},{"url":"http://github.com/craftcms/cms/pull/17026","tags":["x_refsource_MISC"]}],"priority":{"score":20.0,"factors":[{"name":"EPSS percentile","points":14.91},{"name":"CVSS severity","points":5.11}]},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 4.0.0-RC1, < 4.14.13",">= 5.0.0-RC1, < 5.6.15"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.0.0-RC1, <4.14.13",">=5.0.0-RC1, <5.6.15"],"patched":["4.14.13","5.6.15"],"from":["GHSA-7c58-g782-9j38"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-13408","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-craft-cms-cms-cve-2023-40035","parents":[{"from":"CVE-2024-52293","to":"CVE-2025-46731","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-f3cw-hg6r-chfv","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-7c58-g782-9j38","via":"reference","url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv"}]}],"packageHistory":[{"cve":"CVE-2024-52292","published":"2024-11-13","fixed":"5.4.9","kev":false},{"cve":"CVE-2024-56145","published":"2024-12-18","fixed":"5.5.2","kev":true},{"cve":"CVE-2025-23209","published":"2025-01-18","fixed":"5.5.8","kev":true,"link":{"from":"CVE-2025-23209","to":"CVE-2025-46731","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.13.8","toFixed":"4.14.13","daysApart":107},{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"5.5.8","toFixed":"5.6.15","daysApart":107}]}},{"cve":"CVE-2025-46731","published":"2025-05-05","fixed":"5.6.15","kev":false},{"cve":"CVE-2025-32432","published":"2025-04-25","fixed":"5.6.17","kev":true},{"cve":"CVE-2025-35939","published":"2025-05-07","fixed":"5.7.5","kev":true},{"cve":"CVE-2025-54417","published":"2025-08-09","fixed":"5.8.4","kev":false}],"package":"Packagist:craftcms/cms"}}