CVEvulnerability

CVE-2025-23209

8.1 HIGH Known exploited Published 2025-01-18 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Craft CMS Code Injection Vulnerability — Craft CMS Craft CMS

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

Added to KEV
2025-02-20
Remediation due
2025-03-13
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x ; https://nvd.nist.gov/vuln/detail/CVE-2025-23209
Status
Analyzed
Published
2025-01-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

Affected configurations

• craftcms craft cms (> 4.0.0 < 4.13.8) • craftcms craft cms (> 5.0.0 < 5.5.8) • craftcms craft cms 4.0.0 • craftcms craft cms 5.0.0

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References