HighGHSA-v64r-7wg9-23prCVE-2025-68456

Unauthenticated Craft CMS users can trigger a database backup

Published 5 Jan 2026 · Updated 3 Feb 2026

Affected packages

craftcms/cmsComposer

Affected: >=5.0.0-RC1 <5.8.21
Fixed in: 5.8.21

Update to the fixed version for your release line, for example:composer require craftcms/cms:^5.8.21

craftcms/cmsComposer

Affected: >=3.0.0 <4.16.17
Fixed in: 4.16.17

Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.16.17

Details

Unauthenticated users can trigger database backup operations the updater/backup action, potentially leading to resource exhaustion or information disclosure.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

References:

https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

Affected Endpoints

POST /admin/actions/updater/backup (unauthenticated)

Vulnerability Details

Root Cause

All updater/* actions are explicitly configured with anonymous access:

// BaseUpdaterController.php  
protected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE;

Attack Vector

1. Send unauthenticated POST request to /admin/actions/updater/backup 2. Database backup executes with configured backupCommand

Is GHSA-v64r-7wg9-23pr in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.