---
title: "Craft CMS: argc/argv RCE and Session-File Injection (KEV)"
url: https://erroneo.us/security/briefs/craft-cms-argc-argv-rce-session-file-injection-kev/
description: "Two exploited Craft CMS bugs: register_argc_argv RCE (fixed 5.5.2/4.13.2/3.9.14) and session-file code injection (fixed 5.7.5/4.15.3). Upgrade and hunt."
type: security-brief
section: "Security Digest"
date_published: 2024-12-18
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-56145", "CVE-2025-35939"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Craft CMS: argc/argv RCE and Session-File Injection (KEV)

**Verdict: Check exposure.** Craft sites on 5.7.5 or 4.15.3 and later are covered for both bugs; anything older, and every Craft 3 site, needs an upgrade and a look for backdoors, because both flaws have been used against internet-facing sites.

- **Who must act:** Owners of self-hosted Craft CMS sites below 5.7.5 or 4.15.3, Craft 3 sites, and any site whose web PHP has register_argc_argv enabled, as in Craft's official Docker image.
- **Who can relax:** Sites already on Craft 5.7.5 or 4.15.3 or later with no signs of earlier compromise; Craft says it firewalled Craft Cloud against CVE-2024-56145.
- **Affected:** CVE-2024-56145: Craft 3.0.0 to before 3.9.14, 4.0.0-RC1 to before 4.13.2, 5.0.0-RC1 to before 5.5.2, when register_argc_argv is On; CVE-2025-35939: Craft before 4.15.3 and 5.x before 5.7.5 (no 3.x fix is listed)
- **Fixed:** CVE-2024-56145: Craft 3.9.14, 4.13.2, 5.5.2 (Nov 19, 2024); CVE-2025-35939: Craft 4.15.3 and 5.7.5 (May 6, 2025)
- **CVEs:** CVE-2024-56145, CVE-2025-35939
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the Craft version on every site (composer show craftcms/cms) and upgrade to 5.7.5 or 4.15.3 or later.
2. In the control panel, open Utilities > PHP Info and set register_argc_argv = Off for the web PHP if it shows On.
3. At the WAF, block query strings matching --[a-zA-Z]*[pP]ath and POSTs to actions/assets/generate-transform that contain __class.
4. Remove PHP from session files and delete unknown PHP files from web and upload folders.
5. If you find a compromise, regenerate the security key (php craft setup/security-key), rotate secrets and database credentials, and force password resets.

### How to check if you are affected

- Grep access logs for query strings containing --templatesPath, --configPath or other --*Path options.
- Grep for GET requests to admin/dashboard with <? or file_put_contents in the query and a 302 response.
- Look for POST requests to actions/assets/generate-transform with __class in the body, or many 404s followed by a 302.
- Search /var/lib/php/sessions for session files containing PHP code, and the web root for filemanager.php or autoload_classmap.php.

## What happened

CISA added two Craft CMS flaws to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-56145) on June 2, 2025.

**CVE-2024-56145** is an unauthenticated RCE that only works when PHP's `register_argc_argv` setting is on for web requests. Craft published [GHSA-2p6p-9rc9-62j9](https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9) on December 18, 2024. The fix had already shipped on November 19 in 3.9.14, 4.13.2 and 5.5.2. A day later, Adam Kues of Assetnote [explained it](https://www.slcyber.io/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms). With the setting on, PHP fills `$_SERVER['argv']` from the query string. Craft read command-line options such as `--templatesPath` without checking that it was on the command line. An attacker could point templates at an `ftp://` server and run code through Twig. Kues notes the setting is on in PHP's default configuration and in Craft's official Docker image. The same day, Craft [said](https://craftcms.com/knowledge-base/craft-cms-argc-and-argv) it had reports of active exploitation. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-56145) scores it 9.8.

**CVE-2025-35939** is quieter. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-35939) says Craft saved the unsanitized return URL of an unauthenticated request in a PHP session file, `/var/lib/php/sessions/sess_<id>`, whose name the client learns from its cookie. That gives an attacker PHP code in a file at a known path. On its own it does nothing, and NVD scores it 5.3. Craft's [5.7.5](https://github.com/craftcms/cms/releases/tag/5.7.5) and [4.15.3](https://github.com/craftcms/cms/releases/tag/4.15.3) releases of May 6, 2025 now sanitize return URLs. CISA's [advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json) ties it to the Yii flaw CVE-2024-58136, which Craft tracks as CVE-2025-32432.

That chain was used in the wild. [Orange Cyberdefense](https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/) described attackers planting PHP in a session file with a request to `admin/dashboard`, then including it through `actions/assets/generate-transform` and a Yii `__class` trick. They then installed a PHP file manager. The write-up credits CVE-2025-32432; its session-file step is the behavior CVE-2025-35939 describes. CVE-2025-32432 was fixed in April 2025 and added to KEV in March 2026.

## Who is affected

Self-hosted Craft below 5.5.2, 4.13.2 or 3.9.14 with `register_argc_argv` on is open to CVE-2024-56145. Craft below 5.7.5 or 4.15.3 is affected by CVE-2025-35939. Per [GHSA-7vrx-9684-xrf2](https://github.com/advisories/GHSA-7vrx-9684-xrf2), no Craft 3 release fixes it. For CVE-2024-56145, Craft says it firewalled Craft Cloud and redeployed unpatched environments.

## Do you really need to act?

If you are on 5.7.5 or 4.15.3 or later, you are covered for both bugs and for CVE-2025-32432. The work then is confirming no one got in earlier, because upgrading does not remove backdoors. Sites on older releases, especially Craft 3, need an upgrade or a hard mitigation now.

## What to do now

1. Check the version with `composer show craftcms/cms`, then upgrade with `php craft update craft`.
2. Set `register_argc_argv = Off` in the PHP config for HTTP requests, restart PHP, and confirm in Utilities > PHP Info.
3. At the WAF, block query strings matching `--[a-zA-Z]*[pP]ath` and `generate-transform` POSTs containing `__class`.
4. If compromised, follow Craft's [cleanup guidance](https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432): remove backdoors, run `php craft setup/security-key`, rotate secrets and database credentials, and force password resets.

## How to tell if you were hit

Grep access logs with `grep -E '[?&]--[a-zA-Z]*[pP]ath' access.log`. Look for `admin/dashboard` requests carrying `<?` or `file_put_contents` that returned 302, and for `generate-transform` POSTs, especially runs of 404s ending in a 302. Run `grep -l '<?' /var/lib/php/sessions/sess_*`, and search the web root for `filemanager.php` or an unexpected `autoload_classmap.php`.

## Timeline

- Nov 19, 2024 — Craft 3.9.14, 4.13.2 and 5.5.2 ship the argc/argv fix.
- Dec 18, 2024 — Craft publishes the advisory for CVE-2024-56145.
- Dec 19, 2024 — The research write-up is published, and Craft learns of active exploitation.
- Apr 10, 2025 — Craft fixes CVE-2025-32432.
- May 6, 2025 — Craft 5.7.5 and 4.15.3 sanitize return URLs.
- May 7, 2025 — CVE-2025-35939 is published.
- Jun 2, 2025 — CISA adds both CVEs to KEV, with a June 23 deadline.

## Sources

1. [Craft CMS — GHSA-2p6p-9rc9-62j9: potential RCE when register_argc_argv is enabled](https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9)
2. [Craft CMS — Craft CMS, argc, and argv](https://craftcms.com/knowledge-base/craft-cms-argc-and-argv)
3. [Craft CMS — 5.7.5 release notes](https://github.com/craftcms/cms/releases/tag/5.7.5)
4. [Craft CMS — 4.15.3 release notes](https://github.com/craftcms/cms/releases/tag/4.15.3)
5. [Craft CMS — Craft CMS and CVE-2025-32432](https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432)
6. [GitHub Advisory — GHSA-7vrx-9684-xrf2](https://github.com/advisories/GHSA-7vrx-9684-xrf2)
7. [CISA — VA-25-147-01: Craft CMS stores user-provided content in session files (CSAF)](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json)
8. [CVE record — CVE-2024-56145](https://www.cve.org/CVERecord?id=CVE-2024-56145)
9. [CVE record — CVE-2025-35939](https://www.cve.org/CVERecord?id=CVE-2025-35939)
10. [NVD — CVE-2024-56145](https://nvd.nist.gov/vuln/detail/CVE-2024-56145)
11. [NVD — CVE-2025-35939](https://nvd.nist.gov/vuln/detail/CVE-2025-35939)
12. [CISA — Known Exploited Vulnerabilities: CVE-2024-56145](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-56145)
13. [CISA — Known Exploited Vulnerabilities: CVE-2025-35939](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939)
14. [Searchlight Cyber (Assetnote) — How an obscure PHP footgun led to RCE in Craft CMS](https://www.slcyber.io/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms)
15. [Orange Cyberdefense SensePost — Investigating an in-the-wild campaign using RCE in CraftCMS](https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/)

---
Source page: https://erroneo.us/security/briefs/craft-cms-argc-argv-rce-session-file-injection-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt