---
id: CVE-2025-68456
title: Craft is a platform for creating digital experiences
summary: >-
  Craft is a platform for creating digital experiences. In versions 5.0.0-RC1
  through 5.8.20 and 3.0.0 through 4.16.16,  unauthenticated users can trigger
  database backup operations via specific admin actions, potentially leading to
  resour…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cwe:
  - CWE-202
  - CWE-770
  - CWE-770
vendor: craftcms
product: craft_cms
affected:
  - 'craft_cms >= 3.0.0, < 4.16.17'
  - 'craft_cms >= 5.0.1, < 5.8.21'
  - craft_cms = 5.0.0
patched:
  - craft_cms 5.8.21
published: '2026-01-05'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T22:10:00.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68456'
references:
  - url: 'https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04'
    label: security-advisories@github.com
  - url: >-
      https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39
    label: security-advisories@github.com
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr'
    label: security-advisories@github.com
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00547
epssPercentile: 0.43739
ingestedAt: '2026-09-30T22:27:27.697Z'
---

## Overview

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16,  unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

## Affected

- `craft_cms >= 3.0.0, < 4.16.17`
- `craft_cms >= 5.0.1, < 5.8.21`
- `craft_cms = 5.0.0`

## Remediation

Upgrade past the affected range:

- `craft_cms 5.8.21`