Craft CMS Remote Code Execution via CVE-2024-56145

Historical catalog analysis: CISA added this entry on June 02, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-56145 is a code injection vulnerability (CWE-94) identified in Craft CMS. This flaw allows for remote code execution (RCE), enabling an attacker to execute arbitrary code on the underlying server hosting the application.

Exposure and applicability

The exploitability of this vulnerability is conditional upon the environment’s PHP configuration. Specifically, the system is vulnerable if the php.ini configuration has the register_argc_argv setting enabled. Organizations using Craft CMS must evaluate both their software version and their PHP runtime settings to determine if they are exposed.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize the following actions to reduce exposure:

1. Configuration Audit: Immediately verify the status of register_argc_argv in the active php.ini file across all web servers hosting Craft CMS. Disabling this setting may serve as a critical immediate mitigation.
2. Vendor Patching: Apply the security updates provided by the vendor to address the underlying code injection flaw.
3. Cloud Service Review: For organizations utilizing cloud-managed services, review configurations in alignment with BOD 22-01 guidance to ensure that managed environments are not inadvertently exposing this vector.
4. Decommissioning: If mitigations cannot be applied or verified, consider discontinuing the use of the product until a secure state is achieved.

How to validate remediation

Verification must go beyond a simple version check of the Craft CMS installation. To confirm that exposure has been reduced, defenders should perform the following:

• Configuration Verification: Confirm via the PHP configuration (e.g., checking phpinfo() or reading the active php.ini) that register_argc_argv is set to Off.
• Patch Confirmation: Verify that the vendor-supplied security update has been successfully deployed and is active in the production environment.

A successful remediation is only verified when both the software patch is applied and the prerequisite PHP configuration is secured or confirmed as non-exploitable.

Limits and open questions

While the vulnerability is documented, it remains unknown whether this flaw has been utilized by ransomware campaigns. Furthermore, while disabling register_argc_argv reduces the attack surface, the residual risk depends on whether other configurations or future vulnerabilities could bypass this requirement. Defenders should note that CISA’s mandated remediation deadlines apply specifically to covered federal agencies and may not reflect the internal policy requirements of private organizations.

Source and editorial note

CVE-2024-56145: Craft CMS Code Injection Vulnerability · Source date: June 02, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: June 05, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 13, 2026 at 00:15 UTC.

Request a Vulnerability Assessment