GHSA-2p6p-9rc9-62j9: Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-56145

Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

High severity GitHub Reviewed Published Dec 18, 2024 in craftcms/cms • Updated Dec 18, 2024

Package

Affected versions

>= 5.0.0-RC1, < 5.5.2

>= 4.0.0-RC1, < 4.13.2

Patched versions

5.5.2

4.13.2

Impact

You are affected if your php.ini configuration has register_argc_argv enabled.

Patches

Update to 4.13.2 or 5.5.2.

Workarounds

If you can’t upgrade yet, and register_argc_argv is enabled, you can disable it to mitigate the issue.

References

• GHSA-2p6p-9rc9-62j9
• craftcms/cms@82e893f

Published to the GitHub Advisory Database

Dec 18, 2024

Last updated

Dec 18, 2024