Open-source package vulnerability · Composer (PHP)

CVE-2024-56145: Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

criticalCVSS 4.0 9.3 · 3.1 9.8ExploitedGHSA-2p6p-9rc9-62j9

Impact You are affected if your php.ini configuration has registerargcargv enabled. Patches Update to 3.9.14, 4.13.2, or 5.5.2. Workarounds If you can't upgrade yet, and registerargcargv is enabled, you can disable it to mitigate the issue.

Published Dec 18, 2024 · Updated Oct 22, 2025

Affected packages

craftcms/cms

Ecosystem: Composer (PHP)
Affected: >= 5.0.0-RC1, < 5.5.2
Fixed in: 5.5.2
Check: composer show craftcms/cms

craftcms/cms

Ecosystem: Composer (PHP)
Affected: >= 4.0.0-RC1, < 4.13.2
Fixed in: 4.13.2
Check: composer show craftcms/cms

craftcms/cms

Ecosystem: Composer (PHP)
Affected: >= 3.0.0, < 3.9.14
Fixed in: 3.9.14
Check: composer show craftcms/cms

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

You are affected if your php.ini configuration has register_argc_argv enabled.

Patches

Update to 3.9.14, 4.13.2, or 5.5.2.

Workarounds

If you can't upgrade yet, and register_argc_argv is enabled, you can disable it to mitigate the issue.

Credited to akues-an.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries