CVE-2025-68456
Critical · 9.1Unauthenticated Craft CMS users can trigger a database backup
CVSS
9.1
EPSS
0.6%
Published
Jan 5, 2026
CISA due date
—
The record
Unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure.Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.Resources: https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | craftcms/cms | 3.0.0 | 4.16.17 |
| Packagist | craftcms/cms | 5.0.0-RC1 | 5.8.21 |
| packagist | craftcms/cms | 3.0.0 | 4.16.17 |
| packagist | craftcms/cms | 5.0.0-RC1 | 5.8.21 |
Related vulnerabilities
- GHSA-v64r-7wg9-23pr Unauthenticated Craft CMS users can trigger a database backup Same vulnerability
- GHSA-234q-vvw3-mrfq Craft CMS has unauthenticated activation email trigger with potential user enumeration Also affects craftcms/cms
- CVE-2026-29069 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28696 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28781 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28784 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28782 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28783 Craft is a content management system (CMS). Also affects craftcms/cms