CVE-2024-56145
Craft CMS Code Injection Vulnerability
Description
CVE-2024-56145 is a critical remote code execution vulnerability in Craft CMS that allows unauthenticated attackers to execute arbitrary code on the server when PHP's register_argc_argv configuration is enabled. The vulnerability affects Craft CMS versions 3.0.0 through 3.9.13, 4.0.0 through 4.13.1, and 5.0.0 through 5.5.1. With a CVSS v3.1 score of 9.8 (CRITICAL), the flaw requires no authentication or user interaction and is trivially exploitable over the network. CISA has added CVE-2024-56145 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 23, 2025, and its EPSS score of 94.05% at the 99.90th percentile confirms near-certain exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| craftcms | craft cms | >= 3.0.0, < 3.9.14; >= 4.0.0, < 4.13.2; >= 5.0.0, < 5.5.2 |
References
- https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3(Patch)
- https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9(Vendor Advisory)
- https://github.com/Chocapikk/CVE-2024-56145(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-56145(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2024-56145 is classified under CWE-94 (Code Injection), a vulnerability class where software constructs code segments using externally influenced input without proper neutralization. In Craft CMS, when register_argc_argv is enabled in PHP configuration, an attacker can inject and execute arbitrary PHP code through the application, achieving full remote code execution with the privileges of the web server process.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2024-56145 has maximum impact across all three CIA dimensions, making it one of the most severe Craft CMS vulnerabilities disclosed. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): An attacker achieves full code execution on the server, enabling access to all data accessible to the web server process including database contents, configuration files with credentials, uploaded files, and potentially other applications hosted on the same server. Integrity (High): Code execution allows the attacker to modify any file, alter database records, install backdoors, deface the website, inject malicious content served to visitors, and pivot to other systems. Availability (High): The attacker can disable the Craft CMS application, corrupt the database, encrypt files for ransomware, or consume system resources. The EPSS score of 94.05% at the 99.90th percentile places this among the most exploited vulnerabilities globally.
Exploit Maturity
CVE-2024-56145 has extremely high exploit maturity with near-certain exploitation activity. Public exploit code is available at GitHub (Chocapikk/CVE-2024-56145), providing a ready-made exploitation tool. CISA has confirmed active exploitation by adding the vulnerability to the Known Exploited Vulnerabilities catalog. The EPSS score of 94.05% at the 99.90th percentile indicates massive exploitation campaigns, placing it in the top 0.1% of all vulnerabilities by exploitation probability. The vulnerability is actively being chained with CVE-2025-35939 (session file injection) to expand the attack surface beyond systems with register_argc_argv enabled. The vendor advisory at GitHub Security Advisory GHSA-2p6p-9rc9-62j9 provides the official disclosure details.
Remediation
-
Update Craft CMS immediately to version 3.9.14, 4.13.2, or 5.5.2, depending on your installed major version. These versions contain the fix for the code injection vulnerability. The patch commit shows the specific changes applied.
-
Disable
register_argc_argvin PHP configuration as an immediate mitigation if patching cannot be performed instantly. Setregister_argc_argv = Offin yourphp.inifile and restart the web server. This removes the prerequisite for exploitation. -
Conduct forensic investigation on all Craft CMS servers, especially those that were running vulnerable versions with
register_argc_argvenabled. Search for web shells, backdoor files, modified Craft CMS core files, unauthorized database changes, and evidence of data exfiltration. -
Rotate all credentials stored in Craft CMS configuration files, including database credentials, email service API keys, S3 bucket keys, and any other secrets in environment files or configuration. If the server was compromised, these credentials must be considered exposed.
-
Implement application-level monitoring to detect code injection attempts. Deploy a WAF with rules targeting PHP code injection patterns and monitor web server logs for unusual request patterns targeting Craft CMS endpoints.
Technical Details
CVE-2024-56145 is a code injection vulnerability in Craft CMS triggered by PHP's register_argc_argv configuration setting. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the most dangerous exploitation profile: network-accessible, low complexity, no authentication, no user interaction. When register_argc_argv is enabled in PHP, the $_SERVER['argv'] array is populated from query string parameters. Craft CMS processes these arguments in a way that allows an attacker to inject arbitrary PHP code that is subsequently evaluated by the application. The specific exploitation vector allows unauthenticated remote code execution, giving the attacker full control of the web server process. Affected versions span the entire Craft CMS 3.x, 4.x, and 5.x release lines: 3.0.0 through 3.9.13, 4.0.0 through 4.13.1, and 5.0.0 through 5.5.1. The fix in patched versions prevents the processing of argv parameters in a code-evaluating context.
Frequently Asked Questions
Is CVE-2024-56145 being actively exploited?
Yes. CVE-2024-56145 is massively exploited with an EPSS score of 94.05% at the 99.90th percentile. Public exploit code is available on GitHub, and CISA has confirmed active exploitation. Immediate patching is critical.
What products are affected by CVE-2024-56145?
Craft CMS versions 3.0.0 through 3.9.13, 4.0.0 through 4.13.1, and 5.0.0 through 5.5.1 are affected when register_argc_argv is enabled in the PHP configuration. The vulnerability is exploitable on any Craft CMS installation meeting this condition.
How do I fix CVE-2024-56145?
Update Craft CMS to version 3.9.14, 4.13.2, or 5.5.2 immediately. As an immediate workaround, disable register_argc_argv in your PHP configuration (php.ini).
How severe is CVE-2024-56145?
CVE-2024-56145 is rated CRITICAL with a CVSS score of 9.8. It allows unauthenticated remote code execution with no user interaction required. The EPSS score of 94.05% at the 99.90th percentile confirms this is among the most actively exploited vulnerabilities globally.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.