CVE-2025-23209

Potential RCE with a compromised security key in craft/cms

Explorada em ataques Alto 8,1 Chance de ataque: 22%

O que é

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

CISA: Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

O que fazer

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Prazo para as agências federais dos EUA: 13 de março de 2025

Adicionada à lista da CISA: 20 de fevereiro de 2025
Publicada: 18 de janeiro de 2025
Gravidade: Alto 8,1 CVSS 3.1
Chance de ataques nos próximos 30 dias (EPSS): 22% entre os 2,4% mais altos de todas as vulnerabilidades conhecidas
Fraqueza: CWE-94
Mais detalhes: NVD · CVE.org · CISA

Todas as referências (3)

Mais falhas exploradas de Craft CMS

Adicionado	Vulnerabilidade	Produto	Gravidade	Chance de ataque
20 de mar. de 2026	Code InjectionCVE-2025-32432	Craft CMS	Crítica 10,0	99,8%
2 de jun. de 2025	Code InjectionCVE-2024-56145	Craft CMS	Crítica 9,3	97%
2 de jun. de 2025	External Control of Assumed-Immutable Web ParameterCVE-2025-35939	Craft CMS	Média 6,9	1,3%

Todas →

Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.