CVE-2025-23209

Potential RCE with a compromised security key in craft/cms

공격에 악용됨 높음 8.1 공격 가능성: 22%

무엇인가

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

CISA: Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

할 일

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

미국 연방 기관 조치 기한: 2025년 3월 13일

CISA 목록에 추가됨: 2025년 2월 20일
게시됨: 2025년 1월 18일
심각도: 높음 8.1 CVSS 3.1
향후 30일 내 공격 가능성(EPSS): 22% 알려진 모든 취약점 중 상위 2.4%
약점 유형: CWE-94
자세히: NVD · CVE.org · CISA

모든 참고 자료(3)

Craft CMS의 다른 악용된 결함

추가됨	취약점	제품	심각도	공격 가능성
2026. 3. 20.	Code InjectionCVE-2025-32432	Craft CMS	치명적 10.0	99.8%
2025. 6. 2.	Code InjectionCVE-2024-56145	Craft CMS	치명적 9.3	97%
2025. 6. 2.	External Control of Assumed-Immutable Web ParameterCVE-2025-35939	Craft CMS	보통 6.9	1.3%

모두 →

출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.