VYPR
← All advisories
Critical severity9.1OSV Advisory· Published Jan 5, 2026· Updated Jun 17, 2026

CVE-2025-68456

CVE-2025-68456

Description

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
craftcms/cmsPackagist
>= 5.0.0-RC1, < 5.8.215.8.21
craftcms/cmsPackagist
>= 3.0.0, < 4.16.174.16.17

Affected products

5
  • Craftcms/CMSOSV
  • Craftcms/Craft CMS3 versions
    cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*range: >=3.0.0,<4.16.17
    • cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*
    • cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*
  • ghsa-coords
    pkg:composer/craftcms/cms
    Range: >= 5.0.0-RC1, < 5.8.21

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.