CVE-2025-46731: Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
Craft CMS contains a potential remote code execution vulnerability via Twig SSTI. You must have administrator access and ALLOWADMINCHANGES must be enabled for this to work.
https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
Note: This is a follow-up to https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv
Users should update to the patched versions (4.14.13 and 5.6.15) to mitigate the issue.
References https://github.com/craftcms/cms/pull/17026
Other sources
Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and ALLOWADMINCHANGES must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46731?
CVE-2025-46731 is considered critical due to its potential for remote code execution if exploited.
How do I fix CVE-2025-46731?
To fix CVE-2025-46731, ensure that you update Craft CMS to version 5.6.15 or 4.14.13 and disable the ALLOW_ADMIN_CHANGES option.
Who is affected by CVE-2025-46731?
CVE-2025-46731 affects versions of Craft CMS prior to 5.6.15 and 4.14.13 with ALLOW_ADMIN_CHANGES enabled.
Is administrator access required to exploit CVE-2025-46731?
Yes, an attacker needs administrator access along with ALLOW_ADMIN_CHANGES enabled to exploit CVE-2025-46731.
What are the symptoms of CVE-2025-46731 being exploited?
Symptoms may include unauthorized actions or changes made within the Craft CMS when exploited.