PT-2025-4848 · Craft · Craft

Angrybrad · Published 2025-01-18 · Updated 2025-08-09 · CVE-2025-23209

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 4.13.8 Craft CMS versions prior to 5.5.8

Description This is a remote code execution (RCE) vulnerability that affects Craft CMS versions 4 and 5, specifically those with compromised security keys. The vulnerability allows attackers to execute arbitrary code on the affected system, potentially leading to unauthorized access and data breaches. According to CISA, this vulnerability is being actively exploited in cyberattacks, with approximately 41,000 instances potentially affected.

Recommendations Update to Craft CMS version 4.13.8 or later. Update to Craft CMS version 5.5.8 or later. If updating is not possible, rotate the security key and ensure its privacy to help mitigate the issue.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-23209

GHSA-2VCF-QXV3-2MGW

GHSA-X684-96HH-833X

Affected Products

Craft

References · 110

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23209.json · Exploit
• https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603 · Patch
• https://osv.dev/vulnerability/CVE-2025-23209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23209 · Security Note
• https://osv.dev/vulnerability/GHSA-x684-96hh-833x · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2vcf-qxv3-2mgw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54417 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57 · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x · Security Note, Vendor Advisory
• https://twitter.com/UndercodeNews/status/1892982473241329674 · Twitter Post
• https://t.me/CVEtracker/29559 · Telegram Post
• https://twitter.com/PVynckier/status/1893678358723969101 · Twitter Post
• https://twitter.com/Inceptus3/status/1892868156143665294 · Twitter Post