ID:11373 - Exploit for Code Injection in Craft CMS - CVE-2025-46731

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when handling Twig templates. A remote privileged user can and execute arbitrary PHP code on the target system.

Note, successful exploitation of the vulnerability requires that ALLOW_ADMIN_CHANGES is enabled.

Remediation