Craft CMS: argc/argv RCE and Session-File Injection (KEV)

What to do

1. Check the Craft version on every site (composer show craftcms/cms) and upgrade to 5.7.5 or 4.15.3 or later.
2. In the control panel, open Utilities > PHP Info and set register_argc_argv = Off for the web PHP if it shows On.
3. At the WAF, block query strings matching --[a-zA-Z]*[pP]ath and POSTs to actions/assets/generate-transform that contain __class.
4. Remove PHP from session files and delete unknown PHP files from web and upload folders.
5. If you find a compromise, regenerate the security key (php craft setup/security-key), rotate secrets and database credentials, and force password resets.

How to check if you are affected or compromised

• Grep access logs for query strings containing --templatesPath, --configPath or other --*Path options.
• Grep for GET requests to admin/dashboard with <? or file_put_contents in the query and a 302 response.
• Look for POST requests to actions/assets/generate-transform with __class in the body, or many 404s followed by a 302.
• Search /var/lib/php/sessions for session files containing PHP code, and the web root for filemanager.php or autoload_classmap.php.

What happened#

CISA added two Craft CMS flaws to KEV on June 2, 2025.

CVE-2024-56145 is an unauthenticated RCE that only works when PHP's register_argc_argv setting is on for web requests. Craft published GHSA-2p6p-9rc9-62j9 on December 18, 2024. The fix had already shipped on November 19 in 3.9.14, 4.13.2 and 5.5.2. A day later, Adam Kues of Assetnote explained it. With the setting on, PHP fills $_SERVER['argv'] from the query string. Craft read command-line options such as --templatesPath without checking that it was on the command line. An attacker could point templates at an ftp:// server and run code through Twig. Kues notes the setting is on in PHP's default configuration and in Craft's official Docker image. The same day, Craft said it had reports of active exploitation. NVD scores it 9.8.

CVE-2025-35939 is quieter. The CVE record says Craft saved the unsanitized return URL of an unauthenticated request in a PHP session file, /var/lib/php/sessions/sess_<id>, whose name the client learns from its cookie. That gives an attacker PHP code in a file at a known path. On its own it does nothing, and NVD scores it 5.3. Craft's 5.7.5 and 4.15.3 releases of May 6, 2025 now sanitize return URLs. CISA's advisory ties it to the Yii flaw CVE-2024-58136, which Craft tracks as CVE-2025-32432.

That chain was used in the wild. Orange Cyberdefense described attackers planting PHP in a session file with a request to admin/dashboard, then including it through actions/assets/generate-transform and a Yii __class trick. They then installed a PHP file manager. The write-up credits CVE-2025-32432; its session-file step is the behavior CVE-2025-35939 describes. CVE-2025-32432 was fixed in April 2025 and added to KEV in March 2026.

Who is affected#

Self-hosted Craft below 5.5.2, 4.13.2 or 3.9.14 with register_argc_argv on is open to CVE-2024-56145. Craft below 5.7.5 or 4.15.3 is affected by CVE-2025-35939. Per GHSA-7vrx-9684-xrf2, no Craft 3 release fixes it. For CVE-2024-56145, Craft says it firewalled Craft Cloud and redeployed unpatched environments.

Do you really need to act?#

If you are on 5.7.5 or 4.15.3 or later, you are covered for both bugs and for CVE-2025-32432. The work then is confirming no one got in earlier, because upgrading does not remove backdoors. Sites on older releases, especially Craft 3, need an upgrade or a hard mitigation now.

What to do now#

1. Check the version with composer show craftcms/cms, then upgrade with php craft update craft.
2. Set register_argc_argv = Off in the PHP config for HTTP requests, restart PHP, and confirm in Utilities > PHP Info.
3. At the WAF, block query strings matching --[a-zA-Z]*[pP]ath and generate-transform POSTs containing __class.
4. If compromised, follow Craft's cleanup guidance: remove backdoors, run php craft setup/security-key, rotate secrets and database credentials, and force password resets.

How to tell if you were hit#

Grep access logs with grep -E '[?&]--[a-zA-Z]*[pP]ath' access.log. Look for admin/dashboard requests carrying <? or file_put_contents that returned 302, and for generate-transform POSTs, especially runs of 404s ending in a 302. Run grep -l '<?' /var/lib/php/sessions/sess_*, and search the web root for filemanager.php or an unexpected autoload_classmap.php.

Timeline#

• Nov 19, 2024 — Craft 3.9.14, 4.13.2 and 5.5.2 ship the argc/argv fix.
• Dec 18, 2024 — Craft publishes the advisory for CVE-2024-56145.
• Dec 19, 2024 — The research write-up is published, and Craft learns of active exploitation.
• Apr 10, 2025 — Craft fixes CVE-2025-32432.
• May 6, 2025 — Craft 5.7.5 and 4.15.3 sanitize return URLs.
• May 7, 2025 — CVE-2025-35939 is published.
• Jun 2, 2025 — CISA adds both CVEs to KEV, with a June 23 deadline.

Vulnerability records

• CVE-2024-56145 · KEV 2025-06-02 · Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.
• CVE-2025-35939 · KEV 2025-06-02 · Craft CMS stores arbitrary content provided by unauthenticated users in session files.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Craft CMS — GHSA-2p6p-9rc9-62j9: potential RCE when register_argc_argv is enabled github.com
2. Craft CMS — Craft CMS, argc, and argv craftcms.com
3. Craft CMS — 5.7.5 release notes github.com
4. Craft CMS — 4.15.3 release notes github.com
5. Craft CMS — Craft CMS and CVE-2025-32432 craftcms.com
6. GitHub Advisory — GHSA-7vrx-9684-xrf2 github.com
7. CISA — VA-25-147-01: Craft CMS stores user-provided content in session files (CSAF) raw.githubusercontent.com
8. CVE record — CVE-2024-56145 cve.org
9. CVE record — CVE-2025-35939 cve.org
10. NVD — CVE-2024-56145 nvd.nist.gov
11. NVD — CVE-2025-35939 nvd.nist.gov
12. CISA — Known Exploited Vulnerabilities: CVE-2024-56145 cisa.gov
13. CISA — Known Exploited Vulnerabilities: CVE-2025-35939 cisa.gov
14. Searchlight Cyber (Assetnote) — How an obscure PHP footgun led to RCE in Craft CMS slcyber.io
15. Orange Cyberdefense SensePost — Investigating an in-the-wild campaign using RCE in CraftCMS sensepost.com