CVE-2024-56145

When the `register_argc_argv` option is enabled in php.ini, Craft CMS processes input in a way that allows code injection and execution of unauthorized code (CWE-94 — improper control of code generation). An attacker without any privileges can remotely invoke an unspecified RCE vector over the network without user interaction. The attack vector details have not been fully disclosed by the vendor.

An attacker can gain full control of the server through remote code execution, threatening the confidentiality, integrity, and availability of the system.

Craft CMS must be updated immediately to version 3.9.14, 4.13.2, or 5.5.2 depending on the branch in use. If an immediate update is not possible, the `register_argc_argv` option should be disabled in php.ini configuration as a temporary workaround.

Craft CMS versions before 3.9.14, before 4.13.2, and before 5.5.2, if the PHP server has the `register_argc_argv` option enabled in php.ini.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.