CVE-2025-68456: Unauthenticated Craft CMS users can trigger a database backup
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.
Other sources
Unauthenticated users can trigger database backup operations the updater/backup action, potentially leading to resource exhaustion or information disclosure.
Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.
References:
https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39
https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
Affected Endpoints
- POST /admin/actions/updater/backup (unauthenticated)
Vulnerability Details
Root Cause All updater/ actions are explicitly configured with anonymous access:
php // BaseUpdaterController.php protected array|bool|int $allowAnonymous = self::ALLOWANONYMOUSLIVE | self::ALLOWANONYMOUSOFFLINE;
Attack Vector 1. Send unauthenticated POST request to /admin/actions/updater/backup 2. Database backup executes with configured backupCommand
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68456?
CVE-2025-68456 has a high severity as it allows unauthenticated users to trigger database backup operations which can lead to resource exhaustion or information disclosure.
How do I fix CVE-2025-68456?
To fix CVE-2025-68456, users should update to version 5.8.21 or 4.16.17 of Craft CMS.
Who is affected by CVE-2025-68456?
CVE-2025-68456 affects Craft CMS versions prior to 5.8.21 and 4.16.17.
Can CVE-2025-68456 be exploited remotely?
Yes, CVE-2025-68456 can be exploited by unauthenticated users remotely.
What actions can trigger the vulnerability in CVE-2025-68456?
Specific admin actions that function without authentication can trigger the database backup operations outlined in CVE-2025-68456.