# MA-1341.062025: MyCERT Advisory - Actively Exploited Critical Vulnerabilities in Craft CMS

**Date:** 10 Jun 2025  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1341.062025  
**Advisory ID:** MA-1341.062025

---

**1.0 Introduction**
Recently, Craft CMS has identified two high-severity vulnerabilities that allow remote attackers to execute malicious code on affected installations. These vulnerabilities are being actively exploited in the wild and affect multiple major versions of Craft CMS.
**2.0 Impact**
The vulnerability **CVE-2024-56145** allows unauthenticated remote attackers to execute arbitrary PHP code if **register\_argc\_argv** is enabled, potentially leading to full system compromise and data breaches. **CVE-2025-35939** vulnerability allows attackers to inject PHP code into session files, which can be exploited via file inclusion to execute code and compromise the system.
**3.0 Affected Products**
Craft CMS **(CVE-2024-56145)**
- Version 4.0.0-RC1 through 4.13.2
- Version 5.0.0-RC1 through 5.5.2
- Version 3.0.0 through 3.9.14
Craft CMS **(CVE-2025-35939)**
- All Versions prior to 5.7.5
- All Versions prior to 4.15.3
**4.0 Recommendations**
CyberSecurity Malaysia encourages users and administrators to review the [Craft CMS Security Bulletin](https://craftcms.com/knowledge-base/security) and apply the necessary updates.
Kindly refer to the following URLs for more information: 
- <https://craftcms.com/knowledge-base/craft-cms-argc-and-argv>
- <https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9>
- <https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3>
- <https://github.com/craftcms/cms/releases/tag/5.7.5>
- <https://github.com/craftcms/cms/releases/tag/4.15.3>
Generally, we advise the users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact the Cyber999 Incident Response Team through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web: [https://www.cybersecurity.my](https://www.mycert.org.my)
**5.0    References**
- <https://github.com/craftcms/cms/security/advisories>
- <https://craftcms.com/knowledge-base/craft-cms-argc-and-argv>
- <https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9>
- <https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3>
- <https://github.com/craftcms/cms/releases/tag/5.7.5>
- <https://github.com/craftcms/cms/releases/tag/4.15.3>
- <https://www.cve.org/CVERecord?id=CVE-2024-56145>
- <https://www.cve.org/CVERecord?id=CVE-2025-35939>