Craft CMS · Craft CMS
CVE-2025-23209
Potential RCE with a compromised security key in craft/cms
What it is
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
CISA: Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: March 13, 2025
More exploited flaws from Craft CMS
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 20, 2026 | Code Injection | Craft CMS | Critical 10.0 | 99.8% |
| Jun 2, 2025 | Code Injection | Craft CMS | Critical 9.3 | 97% |
| Jun 2, 2025 | External Control of Assumed-Immutable Web Parameter | Craft CMS | Medium 6.9 | 1.3% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.