CVE-2024-56145

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

Exploited in attacks Critical 9.3 Attack chance: 97%

What it is

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

CISA: Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: June 23, 2025

Added to the CISA list: June 2, 2025
Published: December 18, 2024
Severity: Critical 9.3 CVSS 4.0
Chance of attacks in the next 30 days (EPSS): 97% in the top 0.1% of all known vulnerabilities
Weakness: CWE-94
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Craft CMS

Added	Vulnerability	Product	Severity	Attack chance
Mar 20, 2026	Code InjectionCVE-2025-32432	Craft CMS	Critical 10.0	99.8%
Jun 2, 2025	External Control of Assumed-Immutable Web ParameterCVE-2025-35939	Craft CMS	Medium 6.9	1.3%
Feb 20, 2025	Code InjectionCVE-2025-23209	Craft CMS	High 8.1	22%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.