CVE-2025-46731: Craft CMS Twig SSTI RCE Vulnerability

CVE-2025-46731 Overview

CVE-2025-46731 is a Remote Code Execution (RCE) vulnerability affecting Craft CMS, a popular content management system. The vulnerability exists due to improper handling of Server-Side Template Injection (SSTI) in the Twig templating engine. This flaw allows authenticated administrators to execute arbitrary code on the server when the ALLOW_ADMIN_CHANGES configuration option is enabled.

Critical Impact

Authenticated administrators can achieve remote code execution on affected Craft CMS installations when ALLOW_ADMIN_CHANGES is enabled, potentially leading to complete server compromise.

Affected Products

• Craft CMS 4.x versions prior to 4.14.13
• Craft CMS 5.x versions prior to 5.6.16
• Craft CMS release candidates including 4.0.0-rc1, 4.0.0-rc2, 4.0.0-rc3, and 5.0.0-rc1

Discovery Timeline

• 2025-05-05 - CVE-2025-46731 published to NVD
• 2025-09-03 - Last updated in NVD database

Technical Details for CVE-2025-46731

Vulnerability Analysis

This vulnerability stems from Server-Side Template Injection (SSTI) in Craft CMS's implementation of the Twig templating engine. Twig is a flexible, fast, and secure template engine for PHP that is widely used in web applications. When user-controlled input is improperly handled within Twig templates, it can lead to arbitrary code execution on the server.

The vulnerability requires two preconditions for successful exploitation: the attacker must have administrator-level access to the Craft CMS installation, and the ALLOW_ADMIN_CHANGES configuration setting must be enabled. While this limits the attack surface to privileged users, it represents a significant risk in environments where administrator accounts may be compromised or where insider threats exist.

Root Cause

The root cause is categorized under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). Craft CMS failed to properly sanitize or restrict template expressions that could be manipulated by administrators through the CMS interface. This allows specially crafted Twig template syntax to break out of the intended template context and execute arbitrary PHP code on the underlying server.

Attack Vector

The attack is network-based and requires authentication with administrator privileges. An attacker with valid administrator credentials can inject malicious Twig template syntax through various CMS features that process template content. When the ALLOW_ADMIN_CHANGES configuration is set to true (which is common in development and staging environments), the injected template code is processed by the Twig engine, leading to server-side code execution.

The exploitation mechanism involves crafting Twig template syntax that leverages built-in functions or filters to access PHP functionality. Since Twig provides various ways to interact with the underlying PHP environment, a sufficiently creative payload can achieve full remote code execution. For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-46731

Indicators of Compromise

• Unusual or unexpected Twig template syntax in CMS content fields, especially containing PHP function calls or system commands
• Administrator account activity logs showing template modifications with suspicious payloads
• Web server logs containing requests with encoded or obfuscated Twig template injection patterns
• Unexpected process spawning or outbound network connections from the web server process

Detection Strategies

• Monitor Craft CMS audit logs for template modifications by administrator accounts, particularly looking for Twig syntax containing filters like |filter or functions accessing system resources
• Implement Web Application Firewall (WAF) rules to detect common SSTI patterns in HTTP requests targeting Craft CMS endpoints
• Review access logs for unusual POST requests to administrative endpoints that handle template content
• Deploy runtime application self-protection (RASP) solutions to detect template injection attempts

Monitoring Recommendations

• Enable comprehensive logging for all administrator actions within Craft CMS and forward logs to a SIEM solution
• Configure alerting for any changes to the ALLOW_ADMIN_CHANGES configuration setting
• Implement file integrity monitoring on Craft CMS template directories to detect unauthorized modifications
• Regularly audit administrator accounts and enforce multi-factor authentication to reduce the risk of credential compromise

How to Mitigate CVE-2025-46731

Immediate Actions Required

• Update Craft CMS to version 4.14.13 or 5.6.16 immediately depending on your installed branch
• Set ALLOW_ADMIN_CHANGES to false in production environments as recommended in the Craft CMS Security Guide
• Audit all administrator accounts and remove any unnecessary privileged access
• Review recent administrator activity logs for any suspicious template modifications

Patch Information

Craft CMS has released patched versions that address this vulnerability. Users on the 4.x branch should upgrade to version 4.14.13 or later. Users on the 5.x branch should upgrade to version 5.6.16 or later. The patch details are available in the GitHub Pull Request #17026.

Workarounds

• Disable ALLOW_ADMIN_CHANGES by setting it to false in your environment configuration, which prevents the vulnerable functionality from being accessible
• Implement strict access controls to limit administrator account access to only essential personnel
• Use a staging environment for all template changes and deploy to production through a controlled CI/CD pipeline rather than direct admin access
• Consider implementing additional network segmentation to restrict access to the Craft CMS administrative interface

# Configuration example - Add to your .env file or config/general.php
# Disable admin changes in production to mitigate this vulnerability
ALLOW_ADMIN_CHANGES=false