CVE-2024-56145 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected Versions**: - Craft CMS **5.0.0-RC1** up to **5.5.2** (before 5.5.2). - Craft CMS **4.0.0-RC** up to **4.13.2** (before 4.13.2). 🏢 **Vendor**: CraftCMS.

Q: Is exploitation threshold high? (Auth/Config)

⚖️ **Exploitation Threshold**: - **Auth**: **Unauthenticated**. No login required. 🔓 - **Config**: Requires `register_argc_argv` to be **enabled** in `php.ini`. This is often default in some environments but not all. 🛠️

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Public Exploits**: **YES**. Multiple PoCs are available on GitHub (e.g., by Chocapikk, Sachinart). Automated scanning templates exist in Nuclei. Wild exploitation is highly likely due to ease of use. 🚀

Q: Is it fixed officially? (Patch/Mitigation)

🛡️ **Official Fix**: **YES**. A patch was released. See GitHub Advisory GHSA-2p6p-9rc9-62j9 and commit `82e893fb794d30563da296bca31379c0df0079b3`. Update to the latest stable version immediately. ✅

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. - Unauthenticated RCE. - Public PoCs available. - Affects major CMS versions. - Immediate patching or mitigation is required. Do not delay! ⏳

Updated May 06, 2026

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Craft CMS suffers from **Remote Code Execution (RCE)** via improper handling of the `--templatesPath` query parameter.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🔍 **Root Cause**: The flaw stems from **CWE-94 (Code Injection)**. Specifically, it exploits the PHP configuration `register_argc_argv` being enabled.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected Versions**: 
- Craft CMS **5.0.0-RC1** up to **5.5.2** (before 5.5.2).
- Craft CMS **4.0.0-RC** up to **4.13.2** (before 4.13.2). 
🏢 **Vendor**: CraftCMS.

Q4What can hackers do? (Privileges/Data)

💻 **Attacker Capabilities**: 
- **Privileges**: Full **Remote Code Execution (RCE)** as the web server user. 
- **Data**: Access to all database contents, user credentials, and server files.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚖️ **Exploitation Threshold**: 
- **Auth**: **Unauthenticated**. No login required. 🔓
- **Config**: Requires `register_argc_argv` to be **enabled** in `php.ini`. This is often default in some environments but not all. 🛠️

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Public Exploits**: **YES**. Multiple PoCs are available on GitHub (e.g., by Chocapikk, Sachinart). Automated scanning templates exist in Nuclei. Wild exploitation is highly likely due to ease of use. 🚀

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check**: 
- Use **Nuclei** with the CVE-2024-56145 template. 
- Check if `register_argc_argv` is On in PHP config. 
- Scan for Craft CMS versions listed above.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🛡️ **Official Fix**: **YES**. A patch was released. See GitHub Advisory GHSA-2p6p-9rc9-62j9 and commit `82e893fb794d30563da296bca31379c0df0079b3`. Update to the latest stable version immediately. ✅

Q9What if no patch? (Workaround)

🚧 **Workaround (If No Patch)**: 
Disable `register_argc_argv` in `php.ini` (set to Off). 
Restrict access to the `--templatesPath` parameter if possible. 
…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. 
- Unauthenticated RCE. 
- Public PoCs available. 
- Affects major CMS versions. 
- Immediate patching or mitigation is required. Do not delay! ⏳

Continue exploring

Vulnerability detail Full AI analysis (login) craftcms CWE-94