Back to search
CVE-2025-57811
Published: Aug 25, 2025
Modified: Aug 25, 2025
PUBLISHED
Description
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.
| Vendor | Product | Versions |
|---|---|---|
craftcms | cms | affected >= 4.0.0-RC1, < 4.16.6affected >= 5.0.0-RC1, < 5.8.7 |
Weaknesses (CWE)
References
https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
x_refsource_CONFIRM
https://github.com/craftcms/cms/pull/17612
x_refsource_MISC
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now