Description
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.
Affected products
craftcms: craft cms
References4
- github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr ExploitVendor Advisory
- github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr ExploitVendor Advisory
- github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf81… Patch
- github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 ProductRelease Notes
Metrics
- CVSS 3.1
-
9.1
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CVSS 4.0
-
7.0
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 47 · as of 11 November 2026
- CWE
- CWE-202CWE-770
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.