CVE-2025-68456: Craft CMS Information Disclosure Flaw

CVE-2025-68456 Overview

CVE-2025-68456 is a high-severity vulnerability affecting Craft CMS, a popular platform for creating digital experiences. The vulnerability allows unauthenticated users to trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. This issue stems from missing authentication checks and improper resource management in the UpdaterController's backup functionality.

Critical Impact

Unauthenticated attackers can trigger database backup operations, leading to potential resource exhaustion (Denial of Service) or sensitive information disclosure from database exports.

Affected Products

• Craft CMS versions 5.0.0-RC1 through 5.8.20
• Craft CMS versions 3.0.0 through 4.16.16
• All Craft CMS 3.x versions (users should upgrade to Craft 4 or 5)

Discovery Timeline

• 2026-01-05 - CVE CVE-2025-68456 published to NVD
• 2026-01-12 - Last updated in NVD database

Technical Details for CVE-2025-68456

Vulnerability Analysis

This vulnerability exists in Craft CMS's update controller functionality, specifically within the actionBackup() method in src/controllers/UpdaterController.php. The core issue is that the backup action could be triggered without proper authentication, and critically, without verifying that migrations were actually pending. This allowed unauthenticated users to initiate database backup operations at will.

The vulnerability combines two weakness types: CWE-202 (Exposure of Sensitive Information Through Data Queries) and CWE-770 (Allocation of Resources Without Limits or Throttling). Together, these create a scenario where attackers can repeatedly trigger resource-intensive database backup operations, leading to denial of service conditions, or potentially access sensitive database contents through the backup mechanism.

Root Cause

The root cause lies in the missing validation check within the actionBackup() method. Prior to the patch, the method would execute database backup operations without first verifying whether migrations were actually pending. This missing authorization and validation allowed the backup functionality to be abused by unauthenticated users who could directly invoke the backup action endpoint.

Attack Vector

The attack is network-based with low complexity, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted requests to the update controller's backup action endpoint. Since the backup operation is resource-intensive (involving full database exports), repeated requests can exhaust server resources, causing denial of service. Additionally, if backup files are stored in accessible locations or error messages leak information, attackers could potentially gain access to sensitive database contents.

// Security patch in src/controllers/UpdaterController.php
     */
    public function actionBackup(): Response
    {
+        // make sure migrations are pending
+        if (!Craft::$app->getUpdates()->getAreMigrationsPending()) {
+            return $this->sendFinished();
+        }
+
        try {
            Craft::$app->getDb()->backup();
        } catch (Throwable $e) {

Source: GitHub Commit Reference

The patch adds a critical check to verify that migrations are pending before allowing the backup operation to proceed. If no migrations are pending, the method returns early without executing the backup, effectively preventing unauthorized abuse of the backup functionality.

Detection Methods for CVE-2025-68456

Indicators of Compromise

• Unusual spike in requests to /admin/actions/updater/backup or similar update controller endpoints
• Multiple database backup files created in unexpected timeframes or locations
• Server resource exhaustion symptoms (high CPU, memory, or disk I/O) correlating with backup requests
• Error logs showing repeated backup operation failures or timeouts

Detection Strategies

• Monitor web server access logs for repeated requests to update controller endpoints from unauthenticated sessions
• Implement rate limiting on admin action endpoints to detect and block abuse attempts
• Configure alerting for unexpected database backup operations or file creation events
• Review application logs for backup operations that occur outside of legitimate update workflows

Monitoring Recommendations

• Enable detailed logging for Craft CMS update controller actions and review regularly
• Monitor server resource utilization and set alerts for abnormal patterns during backup operations
• Implement network-level monitoring for suspicious traffic patterns targeting admin endpoints
• Use SentinelOne's Singularity Platform to detect anomalous process behavior associated with database operations

How to Mitigate CVE-2025-68456

Immediate Actions Required

• Upgrade Craft CMS 5.x installations to version 5.8.21 or later immediately
• Upgrade Craft CMS 4.x installations to version 4.16.17 or later immediately
• Craft CMS 3.x users should migrate to Craft CMS 4 or 5 with the latest security patches
• Implement Web Application Firewall (WAF) rules to restrict access to update controller endpoints

Patch Information

Craft CMS has released security patches addressing this vulnerability. Version 5.8.21 and version 4.16.17 contain the fix that adds proper validation checks before allowing backup operations. The patch ensures that the actionBackup() method verifies migrations are pending before executing database backups, preventing abuse by unauthenticated users.

For detailed patch information, refer to the GitHub Security Advisory GHSA-v64r-7wg9-23pr and the GitHub Changelog Update.

Workarounds

• Restrict access to the update controller endpoints via web server configuration or firewall rules
• Implement IP-based access controls limiting admin action endpoints to trusted networks only
• Disable the update controller temporarily if not actively using Craft's built-in update functionality
• Monitor and rate-limit requests to sensitive admin endpoints until patches can be applied

# Example Nginx configuration to restrict access to update controller
location ~* /admin/actions/updater {
    allow 10.0.0.0/8;       # Allow internal network
    allow 192.168.0.0/16;   # Allow private network
    deny all;               # Deny all other access
}