Description
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | >= 4.0.0-RC1, < 4.16.6, >= 5.0.0-RC1, < 5.8.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | craftcms/cms | >= 4.0.0-RC1, < 4.16.6 | 4.16.6 | GHSA-crcq-738g-pqvc |
| Packagist | craftcms/cms | >= 5.0.0-RC1, < 5.8.7 | 5.8.7 | GHSA-crcq-738g-pqvc |