Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-tfc8-rkdd-53f7
Vulnerability ID VCID-tfc8-rkdd-53f7
Aliases CVE-2025-57811
GHSA-crcq-738g-pqvc
Summary Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2025-57811
cvssv4 6.6 https://github.com/craftcms/cms
generic_textual MODERATE https://github.com/craftcms/cms
cvssv4 6.1 https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
cvssv4 6.6 https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
generic_textual MODERATE https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
ssvc Track https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
cvssv4 6.1 https://github.com/craftcms/cms/pull/17612
cvssv4 6.6 https://github.com/craftcms/cms/pull/17612
generic_textual MODERATE https://github.com/craftcms/cms/pull/17612
ssvc Track https://github.com/craftcms/cms/pull/17612
cvssv4 6.1 https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
cvssv4 6.6 https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
generic_textual MODERATE https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
ssvc Track https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
cvssv4 6.6 https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv
generic_textual MODERATE https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv
cvssv4 6.6 https://nvd.nist.gov/vuln/detail/CVE-2025-57811
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-57811
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-57811
https://nvd.nist.gov/vuln/detail/CVE-2025-57811
17612 https://github.com/craftcms/cms/pull/17612
e77f8a287dcdda41f1724f525d03542f18566cbc https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
GHSA-crcq-738g-pqvc https://github.com/advisories/GHSA-crcq-738g-pqvc
GHSA-crcq-738g-pqvc https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
GHSA-f3cw-hg6r-chfv https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/craftcms/cms
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-25T18:05:02Z/ Found at https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms/pull/17612
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/craftcms/cms/pull/17612
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-25T18:05:02Z/ Found at https://github.com/craftcms/cms/pull/17612
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-25T18:05:02Z/ Found at https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2025-57811
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.45622
EPSS Score 0.00227
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:14:38.037110+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/57xxx/CVE-2025-57811.json 38.6.0