CVE-2025-68456: Craft CMS Information Disclosure Flaw

CVE-2025-68456 Overview

CVE-2025-68456 is a high-severity vulnerability in Craft CMS, a popular platform for creating digital experiences. This flaw allows unauthenticated users to trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. The vulnerability affects Craft CMS versions 5.0.0-RC1 through 5.8.20 and versions 3.0.0 through 4.16.16.

Critical Impact

Unauthenticated attackers can trigger resource-intensive database backup operations, potentially causing denial of service through resource exhaustion or gaining access to sensitive database information through information disclosure.

Affected Products

• Craft CMS versions 5.0.0-RC1 through 5.8.20
• Craft CMS versions 3.0.0 through 4.16.16
• All Craft 3 installations (migration to Craft 4/5 required)

Discovery Timeline

• 2025-12-04 - Craft CMS releases security patch in version 5.8.21
• 2026-01-05 - CVE-2025-68456 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-68456

Vulnerability Analysis

This vulnerability falls under CWE-202 (Exposure of Sensitive Information Through Data Queries), which involves the improper exposure of sensitive data through system operations. The core issue lies in the UpdaterController.php file where the actionBackup() method could be invoked without proper authentication checks. This allows unauthenticated users to initiate database backup operations that would normally require administrative privileges.

The attack is network-based and does not require any user interaction or prior authentication. When exploited, attackers can repeatedly trigger database backup operations, consuming server resources (CPU, disk I/O, storage space) and potentially causing service degradation or complete denial of service. Additionally, depending on server configuration, the backup files could potentially be accessible, leading to information disclosure of sensitive database contents.

Root Cause

The root cause stems from missing authorization checks in the actionBackup() method within src/controllers/UpdaterController.php. The backup endpoint was accessible without verifying whether database migrations were actually pending, allowing the backup function to be triggered arbitrarily by any user, authenticated or not. This represents a broken access control flaw where sensitive administrative functionality was exposed without proper authentication gates.

Attack Vector

The attack is conducted over the network by sending requests to the vulnerable backup endpoint. An attacker does not need any credentials or prior access to exploit this vulnerability. The attack flow involves:

1. Attacker identifies a Craft CMS installation running a vulnerable version
2. Attacker sends crafted requests to trigger the actionBackup() endpoint
3. Each request initiates a full database backup operation
4. Repeated requests can exhaust server resources (disk space, CPU, I/O)
5. Backup files may potentially expose sensitive database contents

      */
     public function actionBackup(): Response
     {
+        // make sure migrations are pending
+        if (!Craft::$app->getUpdates()->getAreMigrationsPending()) {
+            return $this->sendFinished();
+        }
+
         try {
             Craft::$app->getDb()->backup();
         } catch (Throwable $e) {

Source: GitHub Commit Update

The patch adds a critical check that verifies migrations are actually pending before allowing the backup operation to proceed. If no migrations are pending, the method returns early without executing the backup, effectively preventing the abuse of this endpoint.

Detection Methods for CVE-2025-68456

Indicators of Compromise

• Unusual spikes in database backup files or backup-related disk activity
• Multiple requests to Craft CMS updater endpoints from unknown or unauthenticated sources
• Server resource exhaustion symptoms (high CPU, disk I/O, storage consumption)
• Unexpected backup files appearing in storage directories

Detection Strategies

• Monitor web server access logs for repeated requests to /actions/updater/backup or similar updater controller endpoints
• Implement rate limiting on administrative endpoints to detect and block rapid successive requests
• Deploy Web Application Firewall (WAF) rules to flag unauthenticated requests to sensitive admin functions
• Enable detailed application logging to track backup operation invocations

Monitoring Recommendations

• Set up alerts for unusual file system activity in Craft CMS backup directories
• Monitor server resource utilization for unexplained spikes correlating with web requests
• Review access logs regularly for patterns of unauthenticated requests to admin endpoints
• Implement anomaly detection for database backup operations outside normal maintenance windows

How to Mitigate CVE-2025-68456

Immediate Actions Required

• Update Craft CMS 5.x installations to version 5.8.21 or later immediately
• Update Craft CMS 4.x installations to version 4.16.17 or later
• Migrate Craft CMS 3.x installations to Craft 4 or 5 with the latest security patches
• Review server logs for evidence of exploitation attempts

Patch Information

Craft CMS has released patched versions that address this vulnerability. The fix adds a validation check to ensure database migrations are actually pending before allowing backup operations to proceed. Users should update to the following patched versions:

• Craft CMS 5.x: Update to version 5.8.21 or later
• Craft CMS 4.x: Update to version 4.16.17 or later
• Craft CMS 3.x: No direct patch available - migration to Craft 4 or 5 is required

For detailed patch information, refer to the GitHub Security Advisory GHSA-v64r-7wg9-23pr and the GitHub Changelog Entry.

Workarounds

• Implement network-level access controls to restrict access to Craft CMS admin endpoints
• Configure WAF rules to block unauthenticated requests to /actions/updater/* endpoints
• Apply rate limiting at the web server or load balancer level for admin paths
• Temporarily disable or restrict access to the updater controller if patching is delayed

# Example nginx configuration to restrict updater endpoint access
location ~* /actions/updater {
    allow 10.0.0.0/8;  # Allow internal network only
    deny all;
    
    # Or alternatively, require basic authentication
    # auth_basic "Restricted Access";
    # auth_basic_user_file /etc/nginx/.htpasswd;
}