7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68456

CVE-2025-68456: Unauthenticated Craft CMS users can trigger a database backup

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68456

CVE-2025-68456:

7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.8.20	5.8.21
craftcms/cms	composer	>= 3.0.0, <= 4.16.16	4.16.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows unauthenticated users to trigger a resource-intensive database backup, leading to a potential denial-of-service. The analysis of the provided information identified two primary entry points for this vulnerability.

The first is the actionBackup method within the craft\controllers\UpdaterController. The provided commit f83d4e0c6b906743206b4747db4abf8164b8da39 directly patches this function by adding a check (Craft::$app->getUpdates()->getAreMigrationsPending()) to ensure that a backup is only performed when there are pending database migrations. Before this patch, the function could be called by an unauthenticated user at any time to trigger a backup.

The second entry point is the actionMigrate method within the craft\controllers\AppController. The vulnerability description and the proof-of-concept code clearly indicate that this action can be used to trigger a backup. This action was configured to allow anonymous access, and when the backupOnUpdate configuration is enabled, it initiates a database backup. Although this function was not modified in the provided patch, it represents a critical path for exploitation.

The root cause of the vulnerability is the improper authorization on these two controller actions, which allows unauthenticated users to access functionality that should be restricted to administrators.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.