| Package | Affected versions | Patched versions |
|---|---|---|
| craftcms/cms | ≥ 4.0.0-RC1, < 4.16.6≥ 5.0.0-RC1, < 5.8.7 | 4.16.65.8.7 |
| craft cms | = 4.0.0= 5.0.0≥ 4.1.0, < 4.16.6≥ 5.1.0, < 5.8.7 | 4.16.65.8.7 |
Note that users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.
https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
Note: This is a follow-up to GHSA-f3cw-hg6r-chfv
Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue.
Resources: https://github.com/craftcms/cms/pull/17612
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free