PT-2025-32419 · Craft · Craft

Segfault-It · CVE-2025-54417 · Published 2025-08-08 · Updated 2025-08-09

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Craft versions 4.13.8 through 4.16.2 Craft versions 5.5.8 through 5.8.3

Description Craft is a platform for creating digital experiences. A vulnerability exists that allows bypassing security measures, potentially leading to remote code execution (RCE) with a compromised security key. To exploit this issue, an attacker must have a compromised security key and the ability to create an arbitrary file in Craft's /storage/backups folder. Exploitation involves sending a malicious request to the /updater/restore-db endpoint, enabling the execution of CLI commands remotely.

Recommendations Craft versions prior to 4.16.3 Craft versions prior to 5.8.4

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-54417

GHSA-2VCF-QXV3-2MGW

Affected Products

Craft

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54417.json · Exploit
• https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57 · Patch
• https://osv.dev/vulnerability/GHSA-2vcf-qxv3-2mgw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23209 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54417 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw · Note
• https://twitter.com/VulmonFeeds/status/1954015696787997019 · Twitter Post
• https://t.me/CVEtracker/29559 · Telegram Post
• https://twitter.com/CVEnew/status/1954014378073940134 · Twitter Post
• https://t.me/cveNotify/131538 · Telegram Post