CVE-2025-68456 is a critical flaw (CVSS 9.1) in Craft CMS. Unauthenticated users can trigger database backup operations through specific admin actions, risking resource exhaustion or information disclosure. Upgrade to Craft 5.8.21 or 4.16.17. Craft 3 sites should move to a current Craft 4 or 5 release.
What's affected
- Craft CMS 5.0.0-RC1 through 5.8.20, fixed in 5.8.21.
- Craft CMS 3.0.0 through 4.16.16, fixed in 4.16.17 on Craft 4.
- Craft 3 has no fixed release listed. The advisory tells Craft 3 users to update to the latest Craft 4 and 5 releases.
How to check if you're exposed
Read the version from the Craft control panel utilities page, or with Composer:
composer show craftcms/cms
Anything in the ranges above needs the update. Also look at your storage folder and web server logs. Backups are written as files, so unexpected database backup files in the storage backups folder, or a burst of requests to admin action URLs from unknown addresses, are worth investigating.
You can also paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. It lists known CVEs for the versions it finds and runs in your browser.
What to do now
- Run the Composer check on each Craft site and note the version.
- Update to 5.8.21 on Craft 5 or 4.16.17 on Craft 4 with
composer update craftcms/cms, then run the migrations Craft prompts for. - Plan the move from Craft 3 to a supported release.
- Check the backups folder for files you did not create, and delete any that you find after review.
- Rotate credentials stored in the database if you believe a backup left the server.
- Make sure backup files are not served by the web server.
Why it matters
The record lists CWE-202, exposure of sensitive information through data queries, and CWE-770, allocation of resources without limits. An action that should need an admin session can be called without one, and creating a database backup is expensive and produces a file full of site data.
Two things follow. Repeated calls can use up disk and processing time. If an attacker can also reach the resulting file, the backup exposes content, user records and configuration. The advisory describes both as possible outcomes.
The record does not list this CVE as exploited in the wild. A fix is a Composer update away on supported lines.
Backups deserve the same access controls as the data they hold. Store site backups outside the web root, restrict them to the account that needs them, and move them off the server on a schedule. A backup file left in a folder that the web server can serve is a common cause of data exposure in many CMS products, not only this one.
If you run several Craft sites, keep a list of each site, its Craft version, and the person who owns upgrades. Many Craft sites are built by agencies for clients, so ask who patches after launch. Without an answer, the site tends to stay on the launch version.
Test the update on a staging copy first, since Craft updates can include database migrations.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Craft versions fix CVE-2025-68456?
5.8.21 on Craft 5 and 4.16.17 on Craft 4. Craft 3 users should move to a current Craft 4 or 5 release.
Sources
- https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr
- https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
Last reviewed: 19 October 2026.
