Craft CMS RCE Exploits PHP argv Handling and FTP Template Loading

CVE-2024-56145 enables unauthenticated remote code execution in Craft CMS when PHP's register_argc_argv setting is enabled. Craft CMS bootstrap code accepted CLI-style options from the web-populated $_SERVER['argv'] array, allowing query-string input to override application paths, including the templates directory. The affected condition was present in Craft CMS's official Docker configuration.

An attacker can redirect template resolution to an attacker-controlled FTP server and leverage PHP's FTP stream wrapper to satisfy file-existence checks before Craft CMS downloads and renders a malicious Twig template. Although Twig blocked several direct dangerous callbacks, the published technique bypassed those restrictions through call_user_func used by the sort filter. Craft CMS fixed the flaw in versions 5.5.2 and 4.13.2 and later; organizations unable to upgrade should disable register_argc_argv and review exposed Craft deployments for suspicious template-path overrides.