CraftCMS 版本 3.9.15 之前的 3.x、4.14.15 之前的 4.x 或 5.6.16 之前的 5.x 容易受到操作端点中远程代码执行 (RCE) 漏洞的影响。

遠端主機上安裝的 CraftCMS 版本為 3.9.15 之前的 3.x、4.14.15 之前的 4.x 或 5.6.16 之前的 5.x，容易受到動作端點中的遠端程式碼執行 (RCE) 弱點影響。

リモートホストにインストールされている CraftCMS のバージョン 3.9.15 より前の 3.x、4.14.15 より前の 4.x、5.6.16 より前の 5.x は、アクションエンドポイントにおけるリモートコード実行 (RCE) に対して脆弱です。

CraftCMS version 3.x prior to 3.9.15 or 4.x prior to 4.14.15 or 5.x prior to 5.6.16 is vulnerable to a Remote Code Execution (RCE) in the action endpoint.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.
    Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before
    5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.
    This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for
    CVE-2023-41892. (CVE-2025-32432)

ID	Name	Product	Family	Published	Updated	Severity
114786	CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 远程代码执行	Web App Scanning	Component Vulnerability	4/29/2025	4/29/2025	critical
114786	CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 遠端程式碼執行	Web App Scanning	Component Vulnerability	4/29/2025	4/29/2025	critical
114786	CraftCMS 3.x < 3.9.15/4.x < 4.14.15/5.x < 5.6.17 のリモートコード実行	Web App Scanning	Component Vulnerability	4/29/2025	4/29/2025	critical
114786	CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 Remote Code Execution	Web App Scanning	Component Vulnerability	4/29/2025	4/29/2025	critical
434234	SCA: security update for craftcms/cms (GHSA-f3gw-9ww9-jmc3)	Tenable Cloud Security	SCA Checks	8/19/2025	8/14/2026	critical
434234	SCA: security update for craftcms/cms (GHSA-f3gw-9ww9-jmc3)	Tenable Self-Hosted Container Security	SCA Checks	8/19/2025	8/14/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical