{"id":"CVE-2025-68456","aliases":["GHSA-v64r-7wg9-23pr"],"url":"https://o3.security/vulnerability/CVE-2025-68456","summary":"Unauthenticated Craft CMS users can trigger a database backup","details":"Unauthenticated users can trigger database backup operations the `updater/backup` action, potentially leading to resource exhaustion or information disclosure.\n\nUsers should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.\n\nCraft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.\n\nReferences:\n\nhttps://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39\n\nhttps://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04\n\n## Affected Endpoints\n\n- `POST /admin/actions/updater/backup` (unauthenticated)\n\n## Vulnerability Details\n\n### Root Cause\nAll `updater/*` actions are explicitly configured with anonymous access:\n\n```php\n// BaseUpdaterController.php  \nprotected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE;\n```\n\n### Attack Vector\n1. Send unauthenticated POST request to `/admin/actions/updater/backup`\n2. Database backup executes with configured `backupCommand`","published":"2026-01-05T22:03:11.155Z","modified":"2026-08-12T03:51:12.981197169Z","cvss":null,"epss":{"score":0.00547,"percentile":0.44561,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.8.21"},{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"4.16.17"}],"fix":{"url":"https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39","label":"craftcms/cms@f83d4e0"},"references":[{"type":"WEB","url":"https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68456.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68456"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.981197169Z"}}