CVE-2025-23209 kev in the critical feed json
Potential RCE with a compromised security key in craft/cms
published 2025-01-18 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-0208 , GHSA-x684-96hh-833x
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Exploited
- added 2025-02-20
- epss
- 21.6%
- EPSS 21.6% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- packagist craftcms/cms 4.13.8, 5.5.8
- craftcms craft_cms 4.13.8, 5.5.5
Timeline
- Published
- Added to CISA KEV
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 20 mo ago
- Patch by
- 2025-03-13 (19 mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Craft CMS, Craft CMS
- CISA name
- Craft CMS Code Injection Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
21.64% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:H |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/cms | >=5.0.0-RC1, <5.5.8 >=4.0.0-RC1, <4.13.8 |
5.5.8 4.13.8 |
Affected products
- craftcms cms
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603
web, patch
-
github.com
/craftcms/cms/security/advisories/GHSA-x684-96hh-833x
web, vendor-advisory
-
craftcms.com
/knowledge-base/securing-craft#keep-your-secrets-secret
web, product
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23209
government-resource, web, us-government-resource
-
nvd.nist.gov
/vuln/detail/CVE-2025-23209
advisory
-
github.com
/craftcms/cms
package
Sources
- CVE List CVE-2025-23209
- GitHub Advisory GHSA-x684-96hh-833x
- NVD CVE-2025-23209
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.