Unauthenticated Craft CMS users can trigger a database backup

CRITICAL 9.1CVE-2025-68456 · GHSA-v64r-7wg9-23pr · Published 05/01/2026 · updated 07/10/2026

Package	Affected versions	Patched versions
craftcms/cms Packagist	`≥ 3.0.0, < 4.16.17≥ 5.0.0-RC1, < 5.8.21`	`4.16.175.8.21`
craft cms craftcms	`= 5.0.0≥ 3.0.0, < 4.16.17≥ 5.0.1, < 5.8.21`	`4.16.175.8.21`

Description

Unauthenticated users can trigger database backup operations the updater/backup action, potentially leading to resource exhaustion or information disclosure.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

References:

https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

Affected Endpoints

POST /admin/actions/updater/backup (unauthenticated)

Vulnerability Details

Root Cause

All updater/* actions are explicitly configured with anonymous access:

// BaseUpdaterController.php  
protected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE;

Attack Vector

Send unauthenticated POST request to /admin/actions/updater/backup
Database backup executes with configured backupCommand

NVD description

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

References

craftcms/cms security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-68456 · ADVISORY
craftcms/cms commit f83d4e0 · WEB
craftcms/cms · PACKAGE
craftcms/cms · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

craftcms/cms

Packagist

≥ 3.0.0, < 4.16.17≥ 5.0.0-RC1, < 5.8.21

4.16.175.8.21

craft cms

craftcms

= 5.0.0≥ 3.0.0, < 4.16.17≥ 5.0.1, < 5.8.21

4.16.175.8.21

Description

Unauthenticated users can trigger database backup operations the updater/backup action, potentially leading to resource exhaustion or information disclosure.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

References:

https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

Affected Endpoints

POST /admin/actions/updater/backup (unauthenticated)

Vulnerability Details

Root Cause

All updater/* actions are explicitly configured with anonymous access:

// BaseUpdaterController.php  
protected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE;

Attack Vector

Send unauthenticated POST request to /admin/actions/updater/backup
Database backup executes with configured backupCommand

NVD description