CVE-2025-23209: Craft CMS Code Injection Vulnerability
Impact
This is an RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised.
https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret
Anyone running an unpatched version of Craft with a compromised security key is affected.
Patches
This has been patched in Craft 5.5.8 and 4.13.8.
Workarounds
If you can't update to a patched version, then rotating your security key and ensuring its privacy will help to migitgate the issue.
References
https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603
Other sources
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
— CISA
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 4.13.8 - Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 5.5.8 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.5.8 - Operational
If updating is not possible, rotate the Craft security key and ensure it remains private.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23209?
CVE-2025-23209 is rated as a critical remote code execution vulnerability affecting Craft CMS installations.
How do I fix CVE-2025-23209?
To fix CVE-2025-23209, upgrade your Craft CMS installation to version 4.13.8 or 5.5.8 or later.
Who is affected by CVE-2025-23209?
CVE-2025-23209 affects users of Craft CMS 4.x and 5.x with a compromised security key.
What are the consequences of CVE-2025-23209?
Exploitation of CVE-2025-23209 could allow an attacker to execute arbitrary code on the affected server.
Is there a way to mitigate CVE-2025-23209?
To mitigate CVE-2025-23209, ensure your security keys are not compromised and upgrade to the patched versions.