CVE-2025-68455 Overview
CVE-2025-68455 is an authenticated Remote Code Execution (RCE) vulnerability affecting Craft CMS, a popular platform for creating digital experiences. The vulnerability exists in versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, allowing attackers with administrator access to the Craft Control Panel to execute arbitrary code on the server through malicious attached Behaviors.
This vulnerability is classified under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), which occurs when an application allows user-supplied input to influence class instantiation or code execution paths without proper validation.
Critical Impact
Authenticated administrators can achieve full Remote Code Execution on servers running vulnerable Craft CMS versions, potentially leading to complete system compromise, data theft, and lateral movement within the network.
Affected Products
- Craft CMS versions 5.0.0-RC1 through 5.8.20
- Craft CMS versions 4.0.0-RC1 through 4.16.16
Discovery Timeline
- 2026-01-05 - CVE-2025-68455 published to NVD
- 2026-01-08 - Last updated in NVD database
Technical Details for CVE-2025-68455
Vulnerability Analysis
The vulnerability stems from improper handling of attached Behaviors within Craft CMS. Behaviors in Yii2-based frameworks like Craft CMS allow developers to extend object functionality dynamically. However, when user-controlled input can influence which Behavior classes are instantiated or how they are configured, it creates a pathway for arbitrary code execution.
An attacker with administrator-level access to the Craft Control Panel can craft a malicious Behavior attachment that, when processed by the application, results in the execution of arbitrary PHP code on the underlying server. While the requirement for administrator access limits the attack surface, this vulnerability is particularly concerning in scenarios involving compromised admin credentials, insider threats, or multi-tenant environments where different trust levels exist.
The attack can be performed over the network without user interaction once administrative access is obtained, making it a significant threat to server integrity and data confidentiality.
Root Cause
The root cause is CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'). The application fails to properly validate or restrict which classes can be instantiated through the Behavior attachment mechanism. This allows an authenticated administrator to specify malicious class names or configurations that result in code execution when the Behavior is processed.
The underlying issue relates to insufficient input validation on class names and parameters passed to the Behavior system, allowing PHP's reflection capabilities to be abused for malicious purposes.
Attack Vector
The attack requires network access to the Craft CMS Control Panel and valid administrator credentials. Once authenticated, an attacker can exploit the vulnerability through the following general approach:
- Access the Craft CMS Control Panel with administrator privileges
- Navigate to functionality that allows attaching Behaviors to elements
- Craft a malicious Behavior specification that references a dangerous class or includes executable payload
- Submit the request, triggering the instantiation and execution of the malicious code
The vulnerability does not require any user interaction beyond the attacker's own actions, and the attack executes with the privileges of the web server process running Craft CMS.
For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-255j-qw47-wjh5.
Detection Methods for CVE-2025-68455
Indicators of Compromise
- Unusual or unexpected PHP process spawning from the web server context
- Suspicious administrator login activity, especially from unfamiliar IP addresses or at unusual times
- Anomalous file system modifications in the Craft CMS installation directory
- Unexpected outbound network connections from the web server
- Log entries showing Behavior-related errors or unusual class instantiation attempts
Detection Strategies
- Monitor Craft CMS application logs for unusual Behavior attachment operations
- Implement web application firewall (WAF) rules to detect and block suspicious Control Panel requests
- Deploy file integrity monitoring on the Craft CMS installation directory
- Review administrator account activity logs for signs of credential compromise or abuse
- Configure alerts for new or modified PHP files outside of normal deployment windows
Monitoring Recommendations
- Enable verbose logging for the Craft Control Panel and review logs regularly
- Implement security information and event management (SIEM) integration for centralized log analysis
- Monitor for indicators of post-exploitation activity such as new user creation, configuration changes, or plugin installations
- Set up real-time alerting on administrator authentication events
How to Mitigate CVE-2025-68455
Immediate Actions Required
- Upgrade Craft CMS to version 5.8.21 or 4.16.17 immediately
- Audit administrator accounts and remove unnecessary privileged access
- Review recent administrator activity logs for signs of exploitation
- Implement network segmentation to limit access to the Craft Control Panel
- Enable multi-factor authentication (MFA) for all administrator accounts
Patch Information
Craft CMS has released patched versions that address this vulnerability. Users should update to version 5.8.21 for the 5.x branch or version 4.16.17 for the 4.x branch. The patches implement proper validation and restrictions on Behavior attachments to prevent arbitrary code execution.
For version 5.x users, the fix is documented in the CraftCMS Changelog Entry. The security patches are available in the following commits:
Workarounds
- Restrict access to the Craft Control Panel to trusted IP addresses only using firewall rules or .htaccess configurations
- Implement a web application firewall (WAF) with rules to monitor and filter suspicious requests to admin endpoints
- Temporarily disable any plugins or custom code that extends Behavior functionality until patches are applied
- Place the site in maintenance mode if immediate patching is not possible and suspicious activity is detected
# Restrict Control Panel access by IP using .htaccess
<Location /admin>
Order Deny,Allow
Deny from all
Allow from 10.0.0.0/8
Allow from 192.168.1.0/24
</Location>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
