Wilfried Pascault

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 3.0.0-RC1 through 3.9.14 Craft CMS versions 4.0.0-RC1 through 4.14.14 Craft CMS versions 5.0.0-RC1 through 5.6.16 **Description** Craft CMS contains a critical issue related to improper code generation management, allowing unauthenticated remote attackers to execute arbitrary code. This high-impact, low-complexity attack vector has been exploited in the wild by the Mimo intrusion set. Attackers use specially crafted GET requests to deploy webshells, which then facilitate the installation of malicious payloads including cryptominers (such as XMRig), proxyware (such as IPRoyal), and loaders. To maintain persistence and hide their presence from system process lists, attackers utilize a dynamically linked library named `alamdar.so` to intercept execution flow. It is estimated that over 28,000 instances are exposed, with hundreds already compromised for financial gain through CPU resource theft and bandwidth hijacking. **Recommendations** Update Craft CMS versions 3.0.0-RC1 through 3.9.14 to version 3.9.15. Update Craft CMS versions 4.0.0-RC1 through 4.14.14 to version 4.14.15. Update Craft CMS versions 5.0.0-RC1 through 5.6.16 to version 5.6.17.