CVE-2025-54417: Craft contains a theoretical bypass for CVE-2025-23209
Pre-requisites:
Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret) Somehow, manage to create an arbitrary file in Craft’s /storage/backups folder.
With those two pieces in place, you could create a specific, malicious request to the /updater/restore-db endpoint to execute CLI commands remotely.
Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
-----
Reported by Marco O. (segfault)
Other sources
Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-23209: "Craft CMS has a potential RCE with a compromised security key". To exploit this vulnerability, the project must meet these requirements: have a compromised security key and create an arbitrary file in Craft's /storage/backups folder. With those criteria in place, attackers could create a specific, malicious request to the /updater/restore-db endpoint and execute CLI commands remotely. This issue is fixed in versions 4.16.3 and 5.8.4.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54417?
CVE-2025-54417 is classified as a high severity vulnerability due to the potential for unauthorized access and file manipulation.
How do I fix CVE-2025-54417?
To mitigate CVE-2025-54417, upgrade Craft CMS to version 5.8.4 or 4.16.3 or later.
What are the pre-requisites for exploiting CVE-2025-54417?
The pre-requisites for exploiting CVE-2025-54417 include having a compromised security key and the ability to create an arbitrary file in the '/storage/backups' folder.
Which versions of Craft CMS are affected by CVE-2025-54417?
CVE-2025-54417 affects Craft CMS versions between 5.5.8 and 5.8.4, and versions between 4.13.8 and 4.16.3.
What type of vulnerability is CVE-2025-54417?
CVE-2025-54417 is a vulnerability that allows for arbitrary file creation, potentially leading to sensitive data exposure.