GHSA-v64r-7wg9-23pr — high GitHub Advisory (CVE-2025-68456) in composer/craftcms/cms

Description

Unauthenticated users can trigger database backup operations the updater/backup action, potentially leading to resource exhaustion or information disclosure.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

References:

https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

Affected Endpoints

POST /admin/actions/updater/backup (unauthenticated)

Vulnerability Details

Root Cause

All updater/* actions are explicitly configured with anonymous access:

// BaseUpdaterController.php  
protected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE;

Attack Vector

Send unauthenticated POST request to /admin/actions/updater/backup
Database backup executes with configured backupCommand

Basic information

Type: reviewed
Severity: high
Advisory on GitHub: Open advisory ↗
Repository advisory: Open repository advisory ↗
Source code: Browse source ↗
Published (advisory): 2026-01-05 18:49:56 UTC
Updated: 2026-01-09 03:11:24 UTC
GitHub reviewed: 2026-01-05 18:49:56 UTC
NVD published: 2026-01-05

Score	Percentile
0.17%	38.51%

CVSS Scores

Base score	Version	Severity	Vector
7.0	4.0	—	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network. Attack complexity (AC:L) Exploitation conditions are straightforward and stable. Attack requirements (AT:P) Additional preconditions must be present for exploitation. Privileges required (PR:N) No privileges are required. User interaction (UI:N) No user interaction is required. Vulnerable system confidentiality impact (VC:H) High confidentiality impact on the vulnerable system. Vulnerable system integrity impact (VI:N) No integrity impact on the vulnerable system. Vulnerable system availability impact (VA:H) High availability impact on the vulnerable system. Subsequent system confidentiality impact (SC:N) No confidentiality impact on subsequent systems. Subsequent system integrity impact (SI:N) No integrity impact on subsequent systems. Subsequent system availability impact (SA:N) No availability impact on subsequent systems. Exploit maturity (threat) (E:P) Proof-of-concept: public PoC exists; no reported exploitation and no known simplification tools.

Identifiers

Type	Value
GHSA	GHSA-v64r-7wg9-23pr ↗
CVE	CVE-2025-68456 ↗

CWEs

CWE id	Name
CWE-202	Exposure of Sensitive Information Through Data Queries
CWE-770	Allocation of Resources Without Limits or Throttling

Credits

h4x0r-dz (reporter)

Affected packages (2)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
composer	craftcms/cms	>= 5.0.0-RC1, <= 5.8.20	5.8.21	—
composer	craftcms/cms	>= 3.0.0, <= 4.16.16	4.16.17	—

Unauthenticated Craft CMS users can trigger a database backup