Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)
Craft CMS
CVE-2024-56145: Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled. CVE-2025-35939: Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432. Added to CISA KEV on 2025-06-02.
Why this severity: CVSS 9.3 (CNA, v4.0); actively exploited (CISA KEV)
- Started
- Jun 2, 2025
- Closed
- Jun 2, 2025
Affected
- See vendor advisory / CISA notes (versions not always listed in KEV feed)
Fixed in
- See vendor advisory linked in sources
Timeline2
CISA added CVE-2024-56145 to the KEV catalog (due 2025-06-23).
CISA added CVE-2025-35939 to the KEV catalog (due 2025-06-23).
Advisories5
Notes & caveats
Derived from CISA KEV JSON feed catalogVersion 2026.10.21. CVSS from the CVE record (cvelistV5). Exact affected/fixed version strings are not always in the KEV record; verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier; many entries are older CVEs newly confirmed as exploited in 2025).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
