CVE-2025-68456: 
PHP vulnerability analysis and mitigation

CVE-2025-68456 is an unauthenticated database backup trigger vulnerability in Craft CMS that allows remote, unauthenticated attackers to initiate database backup operations via the updater/backup admin action endpoint. It affects Craft CMS versions 3.0.0 through 4.16.16 and 5.0.0-RC1 through 5.8.20. The vulnerability was published on January 3, 2026, by researcher h4x0r-dz, and patched versions were released shortly after. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 7.0 (High) (Github Advisory).

The root cause lies in BaseUpdaterController.php, where all updater/* actions are explicitly configured to allow anonymous access via $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE, bypassing any authentication requirement (Github Advisory). This misconfiguration means the actionBackup() method in UpdaterController.php — which triggers a full database backup using the configured backupCommand — is reachable by any unauthenticated user via a POST request to /admin/actions/updater/backup. The vulnerability is classified under CWE-202 (Exposure of Sensitive Information Through Data Queries) and CWE-770 (Allocation of Resources Without Limits or Throttling). The fix, introduced in commit f83d4e0, adds a guard check requiring pending migrations before allowing the backup to proceed (Patch Commit).

Successful exploitation allows unauthenticated attackers to repeatedly trigger resource-intensive database backup operations, consuming server CPU, disk space, and memory, potentially causing denial of service for legitimate users. Additionally, depending on server configuration and backup storage paths, the generated backup files may be accessible to attackers, leading to disclosure of sensitive database contents including user credentials, content, and configuration data. There is no integrity impact, but the combined availability and confidentiality risks result in a high overall severity (Github Advisory, Feedly).

A proof-of-concept exploit is publicly referenced in the GitHub security advisory, and the CVSS v4.0 exploit maturity is rated as "Proof of Concept" (Github Advisory). There is no confirmed evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.059% (low probability of exploitation in the next 30 days), though the GitHub Advisory Database lists it at 0.214% (44th percentile). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A threat intelligence blog post titled "Craft CMS Under Siege: Exploiting CVE-2025-68456 for Remote Code Execution" has appeared, suggesting researcher interest in chaining this vulnerability with others (Feedly).

1. Reconnaissance: Identify internet-facing Craft CMS installations using tools like Shodan or Censys, searching for the Craft CMS admin panel or characteristic HTTP headers. Confirm the version is between 3.0.0–4.16.16 or 5.0.0-RC1–5.8.20.
2. Locate the vulnerable endpoint: The affected endpoint is POST /admin/actions/updater/backup, which is publicly accessible due to the anonymous access configuration in BaseUpdaterController.php.
3. Send unauthenticated POST request: Without any authentication headers or session tokens, send a POST request to https://<target>/admin/actions/updater/backup. No special payload body is required — the backup operation is triggered by the request itself.
4. Trigger resource exhaustion: Repeat the request in rapid succession to exhaust server CPU, disk space, and memory, causing denial of service for legitimate users.
5. Attempt information disclosure: If the server is misconfigured to store or serve backup files in a web-accessible directory, attempt to retrieve the generated database backup file to extract sensitive data such as user credentials, content, and configuration (Github Advisory, Patch Commit).

• Network: Repeated unauthenticated POST requests to /admin/actions/updater/backup from external or unexpected IP addresses; high-frequency requests to this endpoint in a short time window.
• Logs: Web server access logs showing POST /admin/actions/updater/backup with HTTP 200 responses from unauthenticated sessions; Craft CMS application logs showing repeated database backup operations initiated outside of normal maintenance windows.
• File System: Unexpected or numerous database backup files (e.g., .sql, .gz, or similar) created in the configured backup directory with timestamps corresponding to suspicious request activity; rapid growth in disk usage in the backup storage path.
• System Resources: Sudden spikes in CPU, memory, or disk I/O usage on the web/database server correlating with the suspicious POST requests (Github Advisory).

Craft CMS users should immediately update to the patched versions: 4.16.17 (for Craft 4 users) or 5.8.21 (for Craft 5 users). Craft 3 users are advised to upgrade to the latest Craft 4 or Craft 5 release, as Craft 3 is no longer receiving security fixes (Github Advisory). As a temporary workaround prior to patching, administrators should implement network-level access controls (e.g., WAF rules or firewall policies) to block unauthenticated access to /admin/actions/updater/* endpoints, restricting them to trusted IP ranges. Additionally, monitoring system resources and database backup directories for anomalous activity is recommended.

The vulnerability was reported by security researcher h4x0r-dz and published by the Craft CMS maintainers on January 3, 2026 (Github Advisory). A threat intelligence blog post from undercodetesting.com explored the potential for chaining CVE-2025-68456 with other vulnerabilities for remote code execution, indicating active researcher interest in the issue (Feedly). No major media coverage or significant social media discussion beyond security community tracking has been identified.