Live › vulnerability › CVE-2024-56145
Go to dashboardCraft CMS contains a code injection flaw that lets a remote request run code on the server when PHP has register_argc_argv enabled. CISA lists it as actively exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Craft CMS Craft CMS | vendor | – | – |
| craftcms craft cms | vendor | >= 3.0.0, < 3.9.14 | 3.9.14 |
| craftcms craft cms | vendor | >= 4.0.0, < 4.13.2 | 4.13.2 |
| craftcms craft cms | vendor | >= 5.0.0, < 5.5.2 | 5.5.2 |
Check php.ini for register_argc_argv (on means exposed); run php -i | grep register_argc_argv to see the effective value.
Upgrade Craft CMS to a patched release per the vendor advisory, or set register_argc_argv = Off in php.ini as a mitigation.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has register_argc_argv enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable register_argc_argv to mitigate the issue.
This page as .md · .json · in your agent: get_signal("CVE-2024-56145")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.