CVE-2024-56145: Craft CMS code injection via register_argc_argv leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with a critical CVSS score, KEV listing, public exploit, and near-maximum EPSS probability.

What it is

Craft CMS contains a code injection flaw (CWE-94) that allows remote code execution when the PHP setting register_argc_argv is enabled. The vendor describes the vector as unspecified but confirms affected users can be exploited remotely. It matters because the flaw is unauthenticated, network-reachable, and rated critical, and it is already listed in CISA KEV.

Impact

An unauthenticated attacker can execute arbitrary code on the server, giving full control of the Craft CMS host and any data or credentials it can reach.

Attack surface

Reachable over the network with no authentication and no user interaction per the CVSS 4.0 vector (AV:N/PR:N/UI:N). Exploitation depends on the target's php.ini having register_argc_argv enabled.

Exploitation

CVE-2024-56145 is in CISA KEV with a 2025-06-23 remediation due date, and a public exploit reference exists on GitHub. EPSS is 0.97446 (99.9th percentile), indicating very high likelihood of exploitation activity.

What to do

• Upgrade Craft CMS to 3.9.14, 4.13.2, or 5.5.2 as directed by the vendor advisory.
• If immediate upgrade is not possible, disable register_argc_argv in php.ini as the vendor's interim mitigation.
• Follow BOD 22-01 guidance for cloud-hosted instances and treat the KEV due date of 2025-06-23 as the remediation deadline.
• Audit for prior compromise (webshells, unexpected admin accounts, outbound connections) before or during patching.
• Restrict network exposure of Craft CMS admin and front-end endpoints where operationally feasible.

Detection

• Search web and PHP logs for requests containing argv-style or CLI-like parameters reaching Craft CMS endpoints.
• Monitor for unexpected PHP file creation or modification under the webroot, especially in writable directories.
• Alert on new or unusual outbound network connections from the Craft CMS host.
• Check php.ini across all Craft CMS hosts to confirm register_argc_argv is disabled or the instance is patched.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.