Description
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | >= 4.0.0-RC1, < 4.13.2, >= 5.0.0-RC1, < 5.5.2, >= 3.0.0, < 3.9.14 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Craft CMS Twig Template Injection RCE via FTP Templates Path
exploit/linux/http/craftcms_ftp_template
GitHub 3 repositories
-
Chocapikk/CVE-2024-56145 ★ 48 · Dec 20, 2024
Unauthenticated RCE on CraftCMS when PHP `register_argc_argv` config setting is enabled
-
Sachinart/CVE-2024-56145-craftcms-rce ★ 4 · Dec 22, 2024
CVE-2024-56145 SSTI to RCE - twig templates
-
hmhlol/craft-cms-RCE-CVE-2024-56145 ★ 0 · Apr 6, 2025
A POC lab environment for CVE-2024-56145 CraftCMS RCE.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Craft CMS - Remote Code Execution via Template Path Manipulation http/cves/2024/CVE-2024-56145.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | craftcms/cms | >= 5.0.0-RC1, < 5.5.2 | 5.5.2 | GHSA-2p6p-9rc9-62j9 |
| Packagist | craftcms/cms | >= 4.0.0-RC1, < 4.13.2 | 4.13.2 | GHSA-2p6p-9rc9-62j9 |
| Packagist | craftcms/cms | >= 3.0.0, < 3.9.14 | 3.9.14 | GHSA-2p6p-9rc9-62j9 |