CVE-2025-68454: 
PHP vulnerability analysis and mitigation

CVE-2025-68454 is a Server-Side Template Injection (SSTI) vulnerability in Craft CMS that allows authenticated attackers to achieve Remote Code Execution (RCE) via malicious Twig map filter payloads. It affects Craft CMS versions 4.0.0-RC1 through 4.16.16 and 5.0.0-RC1 through 5.8.20. The advisory was published on January 3, 2026, and the CVE was added to the NVD on January 5, 2026. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 5.2 (Medium) (GitHub Advisory, Github Advisory).

The vulnerability is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), specifically an SSTI in Craft CMS's Twig templating engine. An attacker can craft a malicious payload using the Twig map filter in text fields that accept Twig input — either under Settings in the Craft control panel or via the System Messages utility — which the server evaluates as executable template code. The fix (commit d82680f) added a checkArrowFunction validation call in src/web/twig/Extension.php to the groupFilter method, preventing unsanitized arrow functions from being passed to the Twig engine. Exploitation requires one of two conditions: (1) administrator access to the Craft Control Panel with allowAdminChanges enabled, or (2) a non-administrator account with access to the System Messages utility regardless of the allowAdminChanges setting (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to execute arbitrary code on the server with the privileges of the web application process, resulting in full compromise of confidentiality, integrity, and availability of the affected Craft CMS installation. An attacker could exfiltrate sensitive data (database credentials, user data, API keys), modify or delete content and files, establish persistent backdoors, and potentially pivot laterally within the hosting environment. The impact is scoped to the vulnerable system itself, with no direct subsequent system impact per the CVSS v4.0 assessment (GitHub Advisory, Github Advisory).

One proof-of-concept reference is noted in the GitHub security advisory, though no weaponized exploit kit or active in-the-wild exploitation has been confirmed as of the advisory date (Github Advisory). The EPSS score is approximately 0.33–0.499%, placing it in the 66th percentile for exploitation probability within 30 days. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access, which limits the attack surface compared to unauthenticated vulnerabilities, but the allowAdminChanges misconfiguration is common in improperly hardened deployments.

1. Reconnaissance: Identify Craft CMS installations running versions 4.0.0-RC1 through 4.16.16 or 5.0.0-RC1 through 5.8.20 using web fingerprinting tools (e.g., Wappalyzer, HTTP response headers, or Craft-specific paths like /admin).
2. Obtain credentials: Acquire valid credentials for an administrator account (if allowAdminChanges is enabled) or any account with access to the System Messages utility.
3. Access vulnerable input field: Log into the Craft Control Panel and navigate to Settings > text fields that accept Twig input, or navigate to the System Messages utility.
4. Craft SSTI payload: Insert a malicious Twig map filter payload into the text field. A basic proof-of-concept SSTI payload using the map filter might look like: {{ ['id'] | map((e) => e | system) | join }} or similar arrow function abuse that passes OS commands through the Twig engine.
5. Trigger execution: Save or preview the template/message containing the payload, causing the Craft CMS Twig engine to evaluate and execute the injected expression server-side.
6. Achieve RCE: The server executes the injected command as the web server process user, enabling reverse shell establishment, data exfiltration, or further post-exploitation activity (GitHub Advisory, Patch Commit).

• Logs: Craft CMS application logs showing template rendering errors or unexpected output from Twig evaluation in Settings or System Messages contexts; web server access logs with POST requests to /admin/settings or /admin/utilities/system-messages containing encoded Twig expressions (e.g., map, arrow functions =>, system, exec, passthru).
• File System: Unexpected new files (web shells, scripts) written to the Craft CMS web root or storage directories; modification timestamps on PHP files in the src/web/ directory inconsistent with the installed version.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, sh, curl, wget, python) with command-line arguments suggesting reverse shell or data exfiltration activity.
• Network: Unexpected outbound connections from the web server to external IPs on non-standard ports, particularly shortly after admin panel activity; DNS lookups for attacker-controlled domains originating from the web server process.

Craft CMS has released patched versions 4.16.17 and 5.8.21 that address this vulnerability; all users should upgrade immediately (GitHub Advisory, Patch Commit). As a temporary workaround prior to patching, set allowAdminChanges to false in production environments (as already recommended by Craft CMS for all non-dev deployments), which eliminates the administrator-based attack path. Additionally, restrict access to the System Messages utility to only fully trusted users, as this utility provides an alternative exploitation path even with allowAdminChanges disabled. Limit administrative access to the Craft Control Panel to essential personnel and monitor access logs for suspicious template-related activity.

The advisory was published by Craft CMS maintainer angrybrad on January 3, 2026, with credit given to researchers RajChowdhury240 (finder) and rlarabee (reporter) (GitHub Advisory). The vulnerability was rated "Moderate" severity by GitHub Advisory Database, reflecting the authenticated precondition requirement. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability tracking and aggregation sites.