{"repro_id":"REPRO-2026-00054","version":2,"title":"Craft CMS: Unauthenticated Database Backup Trigger","repro_type":"security","status":"published","severity":"medium","description":"Unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure.","ghsa_id":"GHSA-v64r-7wg9-23pr","cve_id":"CVE-2025-68456","source_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68456","package":{"name":"craftcms/cms","ecosystem":"composer"},"reproduced_at":"2026-01-08T11:28:39.561312+00:00","duration_secs":2205.69241976738,"tool_calls":51,"turns":2,"handoffs":1,"quality":{"idempotent_verified":false,"community_verifications":0},"key_moments":[{"agent":"repro","description":"The exploit reproduction script was created, marking the development of the proof of concept.","index":8,"time":2205688.689470291,"title":"Reproduction Script Written","type":"poc_created"},{"agent":"repro","description":"The reproduction script was first executed, attempting to trigger the vulnerability.","index":9,"time":2205688.8732910156,"title":"Initial Exploit Execution","type":"vuln_triggered"},{"agent":"repro","description":"Successful MySQL connection confirmed the vulnerable environment was properly set up.","index":29,"time":2205690.2577877045,"title":"Database Connectivity Verified","type":"env_setup"},{"agent":"repro","description":"Querying MariaDB user authentication methods provided critical insight into the environment's security posture.","index":43,"time":2205690.998315811,"title":"User Authentication Details Checked","type":"discovery"},{"agent":"repro","description":"The self-contained reproduction script was completed and confirmed, indicating successful verification of the vulnerability.","index":54,"time":2205691.8199062347,"title":"Reproduction Script Finalized","type":"confirmation"}],"published_at":"2026-01-08T11:28:51.694512+00:00","retracted":false,"artifacts":[{"path":"bundle/reproduction_steps.sh","filename":"reproduction_steps.sh","size":11728,"category":"reproduction_script"},{"path":"bundle/repro/rca_report.md","filename":"rca_report.md","size":3786,"category":"analysis"},{"path":"bundle/ticket.md","filename":"ticket.md","size":4373,"category":"ticket"},{"path":"bundle/logs/php-server-20260108-105857.log","filename":"php-server-20260108-105857.log","size":99719,"category":"log"},{"path":"bundle/logs/run-20260108-111029.log","filename":"run-20260108-111029.log","size":4012,"category":"log"},{"path":"bundle/logs/run-20260108-111630.log","filename":"run-20260108-111630.log","size":6047,"category":"log"},{"path":"bundle/logs/run-20260108-110610.log","filename":"run-20260108-110610.log","size":4559,"category":"log"},{"path":"bundle/logs/run-20260108-111918.log","filename":"run-20260108-111918.log","size":30710,"category":"log"},{"path":"bundle/logs/php-server-20260108-111918.log","filename":"php-server-20260108-111918.log","size":9359,"category":"log"},{"path":"bundle/logs/mysql-20260108-110310.log","filename":"mysql-20260108-110310.log","size":62,"category":"log"},{"path":"bundle/logs/curl-20260108-105607.log","filename":"curl-20260108-105607.log","size":1888,"category":"log"},{"path":"bundle/logs/run-20260108-105857.log","filename":"run-20260108-105857.log","size":41287,"category":"log"},{"path":"bundle/logs/run-20260108-105607.log","filename":"run-20260108-105607.log","size":31944,"category":"log"},{"path":"bundle/logs/mysql-20260108-105857.log","filename":"mysql-20260108-105857.log","size":62,"category":"log"},{"path":"bundle/logs/run-20260108-110310.log","filename":"run-20260108-110310.log","size":21290,"category":"log"},{"path":"bundle/logs/mysql-20260108-105607.log","filename":"mysql-20260108-105607.log","size":62,"category":"log"},{"path":"bundle/logs/run-20260108-111338.log","filename":"run-20260108-111338.log","size":4012,"category":"log"},{"path":"bundle/logs/php-server-20260108-105607.log","filename":"php-server-20260108-105607.log","size":501,"category":"log"},{"path":"bundle/logs/run-20260108-111757.log","filename":"run-20260108-111757.log","size":2919,"category":"log"}]}