Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-68455
Good to know:
Date: January 5, 2026
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.
Severity Score
Related Resources (8)
Severity Score
Weakness Type (CWE)
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-470Top Fix
Upgrade Version
Upgrade to version craftcms/cms - 5.8.21;craftcms/cms - 4.16.17;https://github.com/craftcms/cms.git - 4.16.17;https://github.com/craftcms/cms.git - 5.8.21
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | HIGH |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |