CVE-2024-52293 Overview
Craft CMS contains a path handling flaw that enables remote code execution through Twig Server-Side Template Injection (SSTI). The vulnerability affects versions prior to 4.12.2 and 5.4.3. The FileHelper::absolutePath function fails to invoke normalizePath, allowing attackers to bypass path handling controls. This flaw is a sequel to CVE-2023-40035 and is tracked under CWE-22 (Path Traversal). Craft CMS resolved the issue in versions 4.12.2 and 5.4.3.
Critical Impact
Authenticated attackers with high privileges can achieve remote code execution on the server via Twig SSTI, resulting in full compromise of confidentiality, integrity, and availability.
Affected Products
- Craft CMS versions prior to 4.12.2 (4.x branch)
- Craft CMS versions prior to 5.4.3 (5.x branch)
- Craft CMS release candidates including 4.0.0-rc1, 4.0.0-rc2, 4.0.0-rc3, and 5.0.0-rc1
Discovery Timeline
- 2024-11-13 - CVE-2024-52293 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-52293
Vulnerability Analysis
Craft CMS is a PHP-based content management system that uses the Twig templating engine for rendering. The vulnerability resides in the FileHelper::absolutePath function within the Craft CMS codebase. The function returns an absolute path but omits a call to normalizePath, which is responsible for resolving path separators and traversal sequences into a canonical form.
Without normalization, attacker-controlled path inputs can reach downstream file operations that eventually feed into Twig template rendering. This enables a Server-Side Template Injection scenario where crafted Twig syntax executes on the server rather than being safely escaped or contained. Successful exploitation results in arbitrary PHP execution in the context of the web server process.
Because the flaw is a sequel to CVE-2023-40035, the previous patch cycle did not fully cover all code paths that construct absolute paths. The fix in commit 123e48a696de1e2f63ab519d4730eb3b87beaa58 reintroduces normalization inside FileHelper::absolutePath.
Root Cause
The root cause is missing path normalization inside FileHelper::absolutePath. Path traversal sequences and non-canonical separators are not neutralized before the path is used to locate or load resources. Attackers leverage this to reach Twig templates or write locations that the developer did not intend to expose to user input.
Attack Vector
The attack is network-based and requires an authenticated account with elevated privileges within Craft CMS. An attacker submits crafted input that flows into FileHelper::absolutePath and subsequently into Twig template evaluation. The Twig engine then processes attacker-controlled expressions, achieving code execution on the underlying PHP runtime.
The vulnerability mechanism is described in the GitHub Security Advisory GHSA-f3cw-hg6r-chfv. No public proof-of-concept exploit code is currently available.
Detection Methods for CVE-2024-52293
Indicators of Compromise
- Unexpected PHP processes spawned from the web server user, including shell invocations or outbound network connections initiated by php-fpm or Apache workers.
- Twig template files or cached compiled templates modified outside of standard deployment windows.
- HTTP requests to Craft CMS control panel endpoints containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or Twig delimiters like {{ and {% in parameters.
- New or altered files under Craft's storage/ or templates/ directories that do not correspond to authorized changes.
Detection Strategies
- Inspect authenticated admin sessions for anomalous file upload or asset management activity by high-privilege users.
- Monitor Craft CMS application logs for errors originating in FileHelper or Twig template compilation failures preceding successful requests.
- Correlate web access logs with process execution telemetry to identify command execution following requests to Craft admin routes.
- Compare the installed Craft CMS version against 4.12.2 and 5.4.3 across all environments to identify vulnerable instances.
Monitoring Recommendations
- Enable audit logging for administrative actions within Craft CMS and forward logs to a centralized SIEM for correlation.
- Alert on any child process creation from the PHP interpreter that is not part of routine application behavior.
- Monitor for outbound connections from web-tier hosts to unfamiliar external addresses immediately after admin authentication events.
How to Mitigate CVE-2024-52293
Immediate Actions Required
- Upgrade Craft CMS to version 4.12.2 or 5.4.3 or later, depending on the deployed branch.
- Audit administrative accounts and remove or rotate credentials for any account that shows signs of unauthorized use.
- Review Twig templates, plugins, and the storage/ directory for unauthorized modifications since the last known-good deployment.
Patch Information
The vendor addressed the issue in Craft CMS 4.12.2 and 5.4.3. The fix restores normalizePath handling inside FileHelper::absolutePath. Review the upstream commit 123e48a and the GitHub Security Advisory GHSA-f3cw-hg6r-chfv for full technical details.
Workarounds
- Restrict access to the Craft CMS control panel using network-layer allowlists or a VPN when immediate patching is not feasible.
- Apply the principle of least privilege for Craft CMS admin roles and reduce the number of accounts with permissions that reach vulnerable code paths.
- Deploy a Web Application Firewall (WAF) rule set to block requests containing Twig delimiters or path traversal sequences targeting Craft admin endpoints.
# Configuration example: upgrade Craft CMS via Composer
composer require craftcms/cms:^5.4.3 --update-with-dependencies
# or, for the 4.x branch
composer require craftcms/cms:^4.12.2 --update-with-dependencies
# Verify installed version
php craft --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
