CVE-2025-46731 Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
Administrators with specific settings enabled can execute arbitrary code via Twig Server-Side Template Injection in Craft CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46731?
CVE-2025-46731 is a high-severity code injection vulnerability in Craftcms Craft Cms, published on 5 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.
Weakness: CWE-1336
Which versions are affected by CVE-2025-46731?
4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.0.0-RC1 | 4.14.13 |
craftcms/cms Packagist | From 4.0.0-RC1 | 4.14.13 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.6.15 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.6.15 |
Products include Craftcms Craft Cms.
How do I fix CVE-2025-46731?
Upgrade craftcms/cms to a fixed version for your release line: 4.14.13 or 5.6.15.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-46731 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46731 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-7c58-g782-9j38.