CVE-2024-52293: Craft CMS

High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days.

Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.

Affected products

• Craft CMS Craft CMS: after 4.0.0, before 4.12.2 (fixed in 4.12.2); after 5.0.0, before 5.4.3 (fixed in 5.4.3); version 4.0.0 only; version 5.0.0 only

Published 2024-11-13. Last modified 2026-06-17.