CVE-2025-46731

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1336

Affected software

Vendor	Product	Versions
craftcms	cms	>= 4.0.0-RC1, < 4.14.13; >= 5.0.0-RC1, < 5.6.15

References

Timeline

Published: May 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-467325.4OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnera CVE-2025-467337.9OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the CVE-2025-467346.4league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark CVE-2025-467351.1Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Te CVE-2025-467365.3Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing o CVE-2025-467377.4SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in th CVE-2025-467386.6An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code.CVE-2025-467398.1An unauthenticated user could discover account credentials via a brute-force attack without rate limiting CVE-2025-46748.6The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configu CVE-2025-467407.5An authenticated user without user administrative permissions could change the administrator Account Name.CVE-2025-467415.7A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.CVE-2025-467424.3Users who were required to change their password could still access system information before changing their password