CVE-2025-57811: Craft CMS Potential Remote Code Execution via Twig SSTI
(updated )
Note that users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS’ recommendations for any non-dev environment.
https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
Note: This is a follow-up to GHSA-f3cw-hg6r-chfv
Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue.
Resources: https://github.com/craftcms/cms/pull/17612
References
- github.com/advisories/GHSA-crcq-738g-pqvc
- github.com/craftcms/cms
- github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
- github.com/craftcms/cms/pull/17612
- github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
- github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv
- nvd.nist.gov/vuln/detail/CVE-2025-57811
Code Behaviors & Features
Detect and mitigate CVE-2025-57811 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →