High severityOSV Advisory· Published Jan 5, 2026· Updated Jan 6, 2026
Unauthenticated Craft CMS users can trigger a database backup
CVE-2025-68456
Description
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
craftcms/cmsPackagist | >= 5.0.0-RC1, < 5.8.21 | 5.8.21 |
craftcms/cmsPackagist | >= 3.0.0, < 4.16.17 | 4.16.17 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-v64r-7wg9-23prghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-68456ghsaADVISORY
- github.com/craftcms/cms/blob/5.x/CHANGELOG.mdghsax_refsource_MISCWEB
- github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39ghsax_refsource_MISCWEB
- github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23prghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.