critical·Product Based Web Vulnerabilities·Updated Jan 6, 2025

CVE-2024-56145 Scanner

CVE-2024-56145 Scanner - Remote Code Execution vulnerability in Craft CMS

Run This Scanner →How to fix it

Est. Time~10 seconds

Scan TypeSingle Scan

Targetsdomain, ipv4, subdomain

CostFree

2.7k

Times Used

continuous scan runs

3.4k

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVECVE-2024-56145

9.3

CVSScritical

Exploitable remotely over the internet · no authentication required.

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

cmsby craftcms

>= 4.0.0-RC1, < 4.13.2

Updated Aug 22, 2026View on NVD →

Detail

Craft CMS is a highly versatile content management system used by developers and organizations for creating and managing websites and digital content. It provides extensive customization options through templates and integrations, making it a popular choice for both small businesses and enterprise-level applications. Craft CMS is designed to offer flexibility and ease of use for web developers and content creators alike.

The Remote Code Execution (RCE) vulnerability in Craft CMS arises due to improper handling of the `--templatesPath` query parameter. This allows attackers to manipulate the parameter to reference malicious Twig templates, enabling arbitrary code execution. The issue is critical and affects multiple versions of the software.

This vulnerability exists in all Craft CMS versions prior to 5.5.2, 4.13.2, and 3.9.14. Exploitation involves crafting a specially designed request to the `--templatesPath` parameter, which can trigger the inclusion and execution of malicious code on the server. The vulnerability requires no prior authentication.

Successful exploitation allows attackers to execute arbitrary commands on the server, potentially gaining full control over the system. This could result in data theft, unauthorized access, or further compromise of the underlying infrastructure. It poses a significant risk to affected systems.

REFERENCES

Solution Advice

Upgrade Craft CMS to version 5.5.2, 4.13.2, or 3.9.14, or later.
If immediate upgrades are not possible, disable `register_argc_argv` as a temporary mitigation.
Implement strict input validation to ensure parameters like `--templatesPath` are sanitized properly.
Monitor server logs for suspicious activity related to the `--templatesPath` parameter.
Regularly conduct security audits to identify and remediate vulnerabilities promptly.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

CVE-2024-56145 Scanner

Check your infrastructure.Right now.

Check your infrastructure.
Right now.