Decoded: Small Business Cybersecurity News & Insights

Critical RCE Vulnerability in Craft CMS

Published Date: December 19, 2024

Package Affected Versions Patched Versions Severity
📦 craftcms/cms (Composer) >= 5.0.0-RC1, < 5.5.2 5.5.2 Critical

Description

Summary of the Vulnerability


Craft CMS has a critical remote code execution (RCE) vulnerability. The issue arises when the PHP configuration setting register_argc_argv is enabled. Attackers could exploit this to execute arbitrary code, putting websites and servers at significant risk.

 

Impact


If register_argc_argv is enabled in your PHP configuration (php.ini), your Craft CMS installation is vulnerable. This setting allows PHP to expose script arguments via $argv and $argc, which attackers can manipulate in certain scenarios.

 

How to Check if You’re Affected



  1. Locate your php.ini file. This is typically found in /etc/php/{version}/cli/php.ini on Linux or via your web server configuration.

  2. Look for the line:


register_argc_argv = On


If it is set to On, your system is at risk.

Patches & Workarounds

Solution


Patches



  • Upgrade Immediately:

    • For Craft CMS 4.x, update to 4.13.2.

    • For Craft CMS 5.x, update to 5.5.2.




To update, use Composer:


composer update craftcms/cms



Workarounds


If upgrading isn’t an option right now:

  • Disable register_argc_argv in php.ini:




register_argc_argv = Off



  • Restart your web server to apply the change:


For Apache:


sudo systemctl restart apache2


For Nginx:


sudo systemctl restart nginx

References

https://nvd.nist.gov/vuln/detail/CVE-2024-56145
Share this:

  • Crypto Regulation in 2025: What You Need to Know

    Cryptocurrency regulation in 2025 looks less like a wild west shootout and more like a paperwork-laden chess match. As the digital asset industry matures, governments around the world are trying to fit crypto into traditional legal frameworks. Some are doing this with a sledgehammer. Others, with a scalpel.

  • How to Secure Your Wi-Fi Network Against Cyber Threats

    Your Wi-Fi network is like the front door to your digital home. If you leave it open, strangers may wander in. This guide shows you how to lock that door and keep unwanted guests out. I promise this guide is clear. Even I had to reread it once or twice (and that was a slow…

  • Cybersecurity Risks of U.S. Trade Tariffs: Impact on Supply Chains in Canada, Mexico & the EU

    In early 2025, the U.S. government announced new tariffs aimed at Canada, Mexico, and potentially the European Union. While the tariffs on Canada and Mexico are temporarily on hold, businesses are already adjusting supply chains to prepare for the financial impact. Trade policies like these cause ripple effects across industries, and cybersecurity often takes a…

  • Dark Web & Small Businesses: How Hackers Sell Your Data

    Many small business owners assume that cyberattacks only target large corporations. They imagine hackers as shadowy figures breaching high-security networks of multinational companies. The reality is much bleaker: small businesses are prime targets because they often lack strong cybersecurity defenses. Worse, once stolen, their data often ends up for sale on the dark web.

  • Top 10 Viruses and Malware Wreaking Havoc in January 2025

    Learn how to identify and defend against the latest cybersecurity threats like Banshee, Clop Ransomware, and AI-powered attacks. Stay one step ahead of hackers with this detailed guide.

  • Should You Invest in DIY AI Assistants?

    With AI technologies advancing rapidly, there’s growing interest in building personal assistants at home. Today, big names like Alexa and Google Home dominate the market, but their capabilities remain limited by their current integrations. Meanwhile, ChatGPT and Google’s Gemini have revolutionized conversational AI, although they lack standalone devices or wake-word functionality. These limitations won’t last…