Live › vulnerability › CVE-2025-23209
Go to dashboardCraft CMS, a PHP content management system, has a code injection flaw in how it validates the database backup path. An attacker can use it to run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Craft CMS Craft CMS | vendor | – | – |
| craftcms craft cms | vendor | > 4.0.0, < 4.13.8 | 4.13.8 |
| craftcms craft cms | vendor | > 5.0.0, < 5.5.8 | 5.5.8 |
| craftcms craft cms | vendor | = 4.0.0 | – |
| craftcms craft cms | vendor | = 5.0.0 | – |
Unknown from the sources.
Apply the vendor mitigation per Craft CMS guidance, or stop using the product if no mitigation exists; the sources do not name a fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
This page as .md · .json · in your agent: get_signal("CVE-2025-23209")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.