Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
●プロフィール ・高1 ・東京近郊在住 ●できること ・オフェンシブセキュリティ全般 ・システムプログラミング(プロトコル実装など) ●実績 ・SecHack365'24 史上最年少 優秀修了 ・情報科学の達人 7期 採択 ・第二回 セキュリティ若手の会 登壇 ・HackTheBox Hacker rank ・CVE-2025-46731 報告
Post summary
The text simply notes that CVE-2025-46731 was reported, without providing any additional technical details or context.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | craftcms | craft_cms | - | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |