{"id":"CVE-2025-23209","kind":"vulnerability","aliases":["CVE-2025-23209"],"related":[],"title":"craftcms craft cms: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond","description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.","summary":"Craft CMS, a PHP content management system, has a code injection flaw in how it validates the database backup path. An attacker can use it to run code on the server.","severity":"critical","cvss":8.1,"epss":null,"exploited":true,"exploited_at":"2025-02-20T00:00:00+00:00","products":[{"name":"Craft CMS Craft CMS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"craftcms craft cms","fixed":["4.13.8"],"affected":"> 4.0.0, < 4.13.8","ecosystem":"vendor"},{"name":"craftcms craft cms","fixed":["5.5.8"],"affected":"> 5.0.0, < 5.5.8","ecosystem":"vendor"},{"name":"craftcms craft cms","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"craftcms craft cms","fixed":[],"affected":"= 5.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["craft-cms","exploited","other","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigation per Craft CMS guidance, or stop using the product if no mitigation exists; the sources do not name a fixed version.","status":"open","published_at":"2025-01-18T01:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:24+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T20:52:24Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per Craft CMS guidance, or stop using the product if no mitigation exists; the sources do not name a fixed version.","reach":"internet","impact":"high","summary":"Craft CMS, a PHP content management system, has a code injection flaw in how it validates the database backup path. An attacker can use it to run code on the server.","category":"other","who_cares":["craft-cms","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the Craft CMS server remotely","analyst_note":"Find the Craft CMS advisory for CVE-2025-23209 to get affected and fixed versions, the backup-path setting involved, and a check for exposure.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000428,"input_tokens":2616,"output_tokens":332,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':23A,26A '-23209':24A,27A '4':113C '4.13.8':148C '5':115C '5.5.8':146C 'affect':111C,138C 'alreadi':122C 'anyon':125C 'attack':74B 'backup':71B 'beyond':21A,101C 'cannot':151C 'cms':3A,11A,29A,31A,34A,37A,40A,43A,46B,54B,91C 'code':62B,80B,106C 'compromis':124C,134C 'content':57B 'craft':2A,4A,28A,30A,33A,36A,39A,42A,45B,53B,84C,112C,131C,145C 'craft-cm':44B 'craftcm':1A 'craftcms':32A,35A,38A,41A 'creat':13A,93C 'custom':14A,94C 'cve':22A,25A 'databas':70B 'digit':15A,95C 'ensur':163C 'execut':107C 'experi':16A,96C 'exploit':47B 'flaw':64B 'flexibl':7A,87C 'friend':10A,90C 'help':167C 'host':52B 'inject':63B 'instal':116C 'issu':170C 'key':120C,136C,161C 'manag':58B 'migitg':168C 'patch':143C,155C 'path':72B 'php':49B,56B 'privaci':165C 'rce':108C 'remot':105C 'rotat':158C 'run':79B,126C 'secur':119C,135C,160C 'self':51B 'self-host':50B 'server':83B 'system':59B 'unpatch':128C 'updat':152C 'use':76B 'user':9A,89C,149C 'user-friend':8A,88C 'valid':68B 'version':129C,156C 'vulner':109C,140C 'web':19A,99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-01-18T01:15:07+00:00","kev":{"dateAdded":"2025-02-20","dueDate":"2025-03-13","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-23209","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-23209","severity":null,"published_at":"2025-02-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-23209","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23209","severity":null,"published_at":"2025-01-18T01:15:07+00:00","modified_at":"2026-06-17T08:52:39+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}