リモートホストにインストールされている CraftCMS のバージョン 3.9.15 より前の 3.x、4.14.15 より前の 4.x、5.6.16 より前の 5.x は、アクションエンドポイントにおけるリモートコード実行 (RCE) に対して脆弱です。

CraftCMS version 3.x prior to 3.9.15 or 4.x prior to 4.14.15 or 5.x prior to 5.6.16 is vulnerable to a Remote Code Execution (RCE) in the action endpoint.

CraftCMS 版本 3.9.15 之前的 3.x、4.14.15 之前的 4.x 或 5.6.16 之前的 5.x 容易受到操作端点中远程代码执行 (RCE) 漏洞的影响。

遠端主機上安裝的 CraftCMS 版本為 3.9.15 之前的 3.x、4.14.15 之前的 4.x 或 5.6.16 之前的 5.x，容易受到動作端點中的遠端程式碼執行 (RCE) 弱點影響。

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.
    Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before
    5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.
    This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for
    CVE-2023-41892. (CVE-2025-32432)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
114786	CraftCMS 3.x < 3.9.15/4.x < 4.14.15/5.x < 5.6.17 のリモートコード実行	Web App Scanning	Component Vulnerability	2025/4/29	2025/4/29	critical
114786	CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 Remote Code Execution	Web App Scanning	Component Vulnerability	2025/4/29	2025/4/29	critical
114786	CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 远程代码执行	Web App Scanning	Component Vulnerability	2025/4/29	2025/4/29	critical
114786	CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 遠端程式碼執行	Web App Scanning	Component Vulnerability	2025/4/29	2025/4/29	critical
434234	SCA: security update for craftcms/cms (GHSA-f3gw-9ww9-jmc3)	Tenable Self-Hosted Container Security	SCA Checks	2025/8/19	2026/7/14	critical
434234	SCA: security update for craftcms/cms (GHSA-f3gw-9ww9-jmc3)	Tenable Cloud Security	SCA Checks	2025/8/19	2026/7/14	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical