What is CVE-2025-68454?

CVE-2025-68454 is a high-severity vulnerability in Craftcms Cms, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 8.8/10. Published 2026-01-05.

How severe is CVE-2025-68454?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Craftcms Cms

CVE-2025-68454

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig `map` filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Published 2026-01-05 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.009 (58.8th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 58.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.008 · newest: 0.009 · change: +0.001

Affected products

Craftcms Cms — versions >= 5.0.0-RC1, < 5.8.21, >= 4.0.0-RC1, < 4.16.17
Craftcms Craft Cms — versions 4.0.0, 5.0.0

Weakness classification (CWE)

CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine

References

github.com/craftcms/cms/security/advisories/GHSA-742x-x762-7383 (Exploit, Vendor Advisory)
github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebe (Patch)
github.com/craftcms/cms/blob/5.x/CHANGELOG.md (Product, Release Notes)

Frequently asked questions

What is CVE-2025-68454?: CVE-2025-68454 is a high-severity vulnerability in Craftcms Cms, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 8.8/10. Published 2026-01-05.
How severe is CVE-2025-68454?: High severity. CVSS v3 base score is 8.8 out of 10.