CVE-2024-56145: Craft CMS remote code execution via register_argc_argv
The short version: Craft CMS has a remote code execution flaw (CVE-2024-56145) that affects installs whose PHP configuration has register_argc_argv enabled — a setting that's on by default in many environments. An unauthenticated attacker can leverage it to run code. It scores 9.8, it's in CISA's KEV catalog, and it's being exploited. Patch, and check that one PHP setting. Steady hands, but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE, actively exploited (with a common config precondition) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (CNA, v4.0) | 9.3 — Critical · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| EPSS | ~97.4% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-06-23 |
| Known exploited? | Yes — added to KEV on evidence of active exploitation; public exploit exists |
| Vulnerability type | CWE-94 code injection → remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Craft CMS installs with PHP register_argc_argv enabled, on versions before the fixes below |
| Fixed in | Craft CMS 3.9.14 · 4.13.2 · 5.5.2 (or later) |
What you need to know
Craft CMS is a popular PHP content-management system. CVE-2024-56145 is a remote code execution flaw that is exploitable when the site's php.ini has register_argc_argv enabled — a setting that ships on by default in many PHP builds, so a large share of Craft installs meet the condition without anyone having chosen it.
A few points to keep in view:
- The precondition is common, not exotic. "Only if
register_argc_argvis on" sounds narrow but often isn't — check it rather than assuming you're safe. - It's unauthenticated and internet-facing. Craft sites are public web applications, so an affected install is directly reachable.
- It's operational. With a public exploit and a KEV listing, exposed installs are being probed.
How serious we see it
High — unauthenticated remote code execution on a public web application, with a public exploit and a KEV listing, is top-of-queue. We keep the honest caveat visible: it requires register_argc_argv to be enabled, so an install with that setting off is not exploitable via this path. But because that setting is a frequent default, the safe assumption is that you're affected until you've confirmed otherwise. The bounded, reassuring part: fixed releases exist across the 3.x, 4.x, and 5.x lines, and both the version and the PHP setting are quick to check.
Recommendations
Straight from Craft's advisory (GHSA-2p6p-9rc9-62j9) and CISA:
- Upgrade now. Move to Craft CMS 3.9.14 / 4.13.2 / 5.5.2 or later.
- If you can't upgrade immediately, disable
register_argc_argv. Turning that PHP setting off mitigates the issue until you can patch. - Confirm your exposure first. Verify your Craft version and whether
register_argc_argvis enabled. - Hunt. Review web and application logs for exploitation attempts and unexpected file writes or process activity.
- If compromised, respond. Rebuild from a known-good state, and rotate application secrets, database credentials, and keys.
How BreachRisk sees it
BreachRisk works from the outside in. Starting from little more than your domain, it discovers your internet-facing web applications, fingerprints Craft CMS and its version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, attacker's-eye view means a Craft site — including one a team stood up outside central IT — is already mapped, so when an RCE like this breaks you can go straight to patch-and-verify.