CVE-2025-68456

Katalog CVE

CVSS 9.1 · Critical EPSS 0,56%

Kerentanan Exposure of Sensitive Information Through Data Queries pada craftcms craft cms. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

Rincian

Terbit di NVD

5 Januari 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-202: Exposure of Sensitive Information Through Data Queries
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr exploit · advisory vendor
• https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39 patch
• https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 product · release notes