PT-2026-1346

CVE-2025-68455

·

Published

2026-01-05

·

Updated

2026-10-07

Description by

CVSS 4.0
8.6
High
MetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Craft versions 5.0.0-RC1 through 5.8.20 Craft versions 4.0.0-RC1 through 4.16.16
Description Craft is a platform for creating digital experiences. The software is susceptible to potential authenticated Remote Code Execution through malicious attached Behavior. An attacker must possess administrator access to the Craft Control Panel to exploit this issue.
Recommendations Update to version 5.8.21 Update to version 4.16.17
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\'Unsafe Reflection\')
Related identifiers
CVE-2025-68455
GHSA-255J-QW47-WJH5
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com