CVE-2025-68456 - CVE House

Back to Database

Status published High CVE-2025-68456

Unauthenticated Craft CMS users can trigger a database backup

7 CVSS

Vulnerability Description

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68456

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from craftcms

View All →

Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Craft Potential Remote Code Execution via Twig SSTI

Affected Vendor

craftcms

View all reports →

Affected Software

cms

Vulnerable Versions:

>= 5.0.0-RC1, < 5.8.21, >= 3.0.0, < 4.16.17

Timeline

Official Publish: January 5th, 2026

Last Modified: January 6th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-770 CWE-202

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery