CVE-2025-23209
Craft CMS: Code Injection
As of , CVE-2025-23209 in Craft CMS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.
- Exploited
- Yes: CISA listed it on 20 February 2025
- US federal deadline
- 13 March 202521 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.22Higher than 97% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- Vendor advice: github.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
CISA's description
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
The CVE record's description, from GitHub_M
- CVE published
- 18 January 2025
- Assigned by
- GitHub_M
- CVSS
- 8.1 High (CVSS 3.1, from the CNA)
- CWE-94
- Improper Control of Generation of Code ('Code Injection')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- CISA changed its entry. Edited: description.
- The US federal deadline to fix it.
Craft CMS: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2025-32432Code Injection | Craft CMS Craft CMS | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| CVE-2024-56145Code Injection | Craft CMS Craft CMS | Patch this weekMetasploit module; EPSS 0.97 | 0.97 | ||
| CVE-2025-35939External Control of Assumed-Immutable Web Parameter | Craft CMS Craft CMS | Patch soon | 0.01 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org