https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T13:11:16.882060+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-264986 EUVD-2026-264986 2026-10-07T13:11:16.937129+00:00 EUVD-2026-264986 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68456 fkie_cve-2025-68456 2026-10-07T13:11:16.937184+00:00

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

 https://cve.radiocsirt.org/vuln/ghsa-v64r-7wg9-23pr GHSA-v64r-7wg9-23pr — Unauthenticated Craft CMS users can trigger a database backup 2026-10-07T13:11:16.937234+00:00

Affected: Packagist: craftcms/cms

Unauthenticated users can trigger database backup operations the `updater/backup` action, potentially leading to resource exhaustion or information disclosure.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

References:

https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

## Affected Endpoints

- `POST /admin/actions/updater/backup` (unauthenticated)

## Vulnerability Details

### Root Cause All `updater/*` actions are explicitly configured with anonymous access:

```php // BaseUpdaterController.php protected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE; ```

### Attack Vector 1. Send unauthenticated POST request to `/admin/actions/updater/backup` 2. Database backup executes with configured `backupCommand`