Actively exploited · Published Jan 18, 2025 · Assigned by GitHub_M
CVE-2025-23209Potential RCE with a compromised security key in craft/cms
High 8.1 Exploited
In plain English
A high-severity code injection in cms from craftcms. Attackers are actively exploiting it in the wild (listed by CISA on February 20, 2025). The chance it is exploited in the next 30 days is estimated at 21.6% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 13, 2025.
Official description
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/cms | 5.5.8 | GHSA-x684-96hh-833x |
| Packagist | craftcms/cms | 4.13.8 | GHSA-x684-96hh-833x |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x x_refsource_CONFIRM
- https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603 x_refsource_MISC
- https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23209 government-resource