CVE-2024-52291: Craft CMS Authentication Bypass Vulnerability

CVE-2024-52291 Overview

Craft CMS contains a path traversal vulnerability that allows authenticated administrators to bypass local file system validation. Attackers can specify a double file:// scheme (for example, file://file:////) to designate sensitive server directories as a Craft file system. This bypass enables malicious uploads that overwrite files, unauthorized reads of sensitive files, and remote code execution through Server-Side Template Injection (SSTI) payloads under specific conditions. Exploitation requires an authenticated administrator account with allowAdminChanges enabled. The flaw is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and is fixed in Craft CMS 5.4.6 and 4.12.5.

Critical Impact
An authenticated administrator can achieve arbitrary file overwrite, sensitive file disclosure, and potential remote code execution on the underlying server.

Affected Products

Craft CMS versions prior to 4.12.5
Craft CMS 5.x versions prior to 5.4.6
Craft CMS 4.0.0 release candidates and 5.0.0 release candidates

Discovery Timeline

2024-11-13 - CVE-2024-52291 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52291

Vulnerability Analysis

Craft CMS validates local file system paths to prevent administrators from pointing a file system at sensitive server directories. The validation logic inspects the supplied path for a file:// scheme prefix and normalizes it. The parser fails to reject inputs that stack the scheme twice, such as file://file:////etc/.

When the crafted path passes validation, Craft treats the target directory as a legitimate storage location. Uploaded assets are written to that directory, and existing files can be read through the assets interface. Because Craft renders templates from configurable paths, an attacker who can write a Twig template into a template directory can trigger SSTI and achieve remote code execution.

Root Cause

The root cause is improper input validation of the file system path parameter. Craft strips or checks the leading file:// scheme but does not recursively normalize the remaining value. The nested second file:// remains after the first is consumed, allowing the check to pass while the underlying filesystem library resolves the full path to an attacker-controlled location on disk.

Attack Vector

Exploitation requires network access to the control panel and valid administrator credentials with allowAdminChanges set to true. The attacker creates or edits a local file system entry in the Craft admin interface and supplies a base path containing the double-scheme payload. After Craft accepts the configuration, the attacker uses the standard asset upload workflow to write files into the referenced directory, or reads files back through the assets browser. See the Craft CMS security advisory GHSA-jrh5-vhr9-qh7q for the vendor's technical description.

Detection Methods for CVE-2024-52291

Indicators of Compromise

File system configuration entries whose base path contains the string file://file: or repeated file:// prefixes.
New or modified assets located outside Craft's designated web/ or storage/ directories.
Unexpected Twig template files (.twig) appearing in template search paths after admin activity.
Audit log entries showing file system create or update actions performed by administrator accounts.

Detection Strategies

Review the craft_filesystems project config and database entries for base paths containing nested URI schemes.
Monitor POST requests to control panel endpoints under /admin/settings/filesystems for suspicious path parameters.
Alert on web server processes writing files to system directories such as /etc, /var, or application source paths.

Monitoring Recommendations

Enable Craft's admin action logging and forward logs to a central SIEM for review of administrator configuration changes.
Track integrity of Craft template directories with file integrity monitoring to detect unauthorized .twig files.
Correlate administrator login events with subsequent file system configuration and asset upload actions.

How to Mitigate CVE-2024-52291

Immediate Actions Required

Upgrade Craft CMS to version 5.4.6 or 4.12.5 or later on all affected installations.
Audit existing local file system definitions for suspicious base paths containing repeated URI schemes.
Rotate credentials for any administrator account whose access cannot be validated as trusted.
Set allowAdminChanges to false in production environments where administrators do not need to modify configuration at runtime.

Patch Information

Craft CMS resolved the issue in versions 5.4.6 and 4.12.5. The patch strengthens local file system path validation to reject nested file:// schemes. Full details are published in the GitHub Security Advisory GHSA-jrh5-vhr9-qh7q.

Workarounds

Disable administrator configuration changes in production by setting allowAdminChanges to false in config/general.php.
Restrict access to the /admin control panel using network controls such as IP allowlisting or VPN gating.
Enforce multi-factor authentication for all administrator accounts to reduce the risk of credential-based abuse.

bash

# Configuration example: disable admin changes in production
# config/general.php
return [
    'production' => [
        'allowAdminChanges' => false,
    ],
];