CVE-2025-23209

Published: Jan 18, 2025Modified: Jun 17, 2026CISA KEV

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

Affected (8)

Products: Craftcms: Craft Cms

Craftcms

1 product

Craft Cms

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Craftcms Craft Cms	4.0.0 < version < 4.13.8
Craftcms Craft Cms	5.0.0 < version < 5.5.8
Craftcms Craft Cms	Version 4.0.0
Craftcms Craft Cms	Version 4.0.0 rc1
Craftcms Craft Cms	Version 4.0.0 rc2
Craftcms Craft Cms	Version 4.0.0 rc3
Craftcms Craft Cms	Version 5.0.0
Craftcms Craft Cms	Version 5.0.0 rc1