Code Injection in Craft CMS (CVE‑2024‑56145) Enables Remote Code Execution
What It Is – Craft CMS versions prior to the vendor’s latest release contain a code‑injection flaw that can be leveraged to execute arbitrary PHP code when the PHP setting register_argc_argv is enabled.
Exploitability – The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog; proof‑of‑concept code is available, and the CVSS base score is 8.8 (High).
Affected Products – Craft CMS (all supported releases that have not been patched).
Why It Matters for Trust & Control Assurance
- Secure Configuration Management – The flaw is triggered only when an insecure PHP configuration (
register_argc_argv) is left enabled, highlighting the need for documented, auditable hardening baselines. - Vulnerability Management – Continuous monitoring for newly disclosed CVEs and rapid patch deployment are core evidence points for a defensible audit trail.
- Control Evidence – Demonstrating that the configuration control is enforced and that remediation steps are logged satisfies a single VCF control objective that maps to multiple frameworks (e.g., NIST CSF 2.0 “Protect” and ISO 27001 A.12.6).
Recommended Actions
- Apply Craft CMS’s latest security patch that addresses CVE‑2024‑56145.
- Immediately disable
register_argc_argvinphp.inior enforce it via a configuration‑as‑code policy. - Add the setting to your baseline configuration controls and record the change in your change‑management system.
- Integrate the CVE into your vulnerability‑scanning feed and set up alerts for any future Craft CMS advisories.
- Capture remediation evidence (patch version, config file diff, scan results) for audit readiness.
Source: CISA KEV – CVE‑2024‑56145