Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-56145

CVE-2024-56145CRITICAL

craftcms cms — RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .9740   99.9   YES

AFFECTED
  Product  Versions                  Fixed
  cms      >= 4.0.0-RC1, < 4.13.2 –  —

TIMELINE
  Dec 16  Reserved by GitHub_M
  Dec 18  Published (CNA: GitHub_M)
  Jun 2   Added to CISA KEV, remediation due 2025-06-23

CWE-94 · CNA: GitHub_M · CVSS v4.0 · 4 references · KEV due June 23, 2025

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
December 16, 2024	Reserved	Reserved by GitHub_M
December 18, 2024	Published	Published (CNA: GitHub_M)
June 2, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-06-23

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
craftcms	cms	—	>= 4.0.0-RC1, < 4.13.2	—

Weaknesses

CWE-94

References (4)

https://github.com/Chocapikk/CVE-2024-56145 [exploit]
https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3 [x_refsource_MISC]
https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9 [x_refsource_CONFIRM]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-56145 [government-resource]

Authoritative record: CVE-2024-56145 at cve.org

Vendors: craftcms

Weaknesses: CWE-94

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-56145 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.