CVE-2025-68454

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig `map` filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

• CWE-1336

• https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04Product, Release Notes
• https://github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebePatch
• https://github.com/craftcms/cms/security/advisories/GHSA-742x-x762-7383Exploit, Vendor Advisory

Published

Jan 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68435Zerobyte is a backup automation tool Zerobyte versions prior…9.1
• CVE-2025-68436Craft is a platform for creating digital experiences. In ver…6.5
• CVE-2025-68437Craft is a platform for creating digital experiences. In ver…6.8
• CVE-2025-68438In Apache Airflow versions before 3.1.6, when rendered templ…7.5
• CVE-2025-6844A vulnerability was found in code-projects Simple Forum 1.0.…9.8
• CVE-2025-6845A vulnerability was found in code-projects Simple Forum 1.0.…9.8
• CVE-2025-68455Craft is a platform for creating digital experiences. Versio…7.2
• CVE-2025-68456Craft is a platform for creating digital experiences. In ver…9.1
• CVE-2025-68457Orejime is a consent manager that focuses on accessibility. …6.1
• CVE-2025-68458Webpack is a module bundler. From version 5.49.0 to before 5…3.7
• CVE-2025-68459RG - AP180, Indoor Wall Plate Wireless AP AP180 series provi…8.6
• CVE-2025-6846A vulnerability classified as critical has been found in cod…7.3