CVE-2025-23209highunder attackCWE-94

CVE-2025-23209: high-severity vulnerability in craftcms cms

Potential RCE with a compromised security key in craft/cms

Published · Updated

Follow this CVE+ Monitor cms+ Monitor Craft CMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.1epss 22%
from disclosure to weapon
Published on NVDJan 18
CISA KEV+33d
Action required by CISAfederal deadline: 2025-03-13

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Craft CMS can execute malicious code if someone obtains your security key. If your security key is stolen, attackers can run arbitrary code on your server.

Technical detail

RCE vulnerability in Craft 4 and 5 exploitable when the security key is compromised; attackers can leverage insecure deserialization (CWE-94) to execute arbitrary code. Mitigation requires updating to Craft 5.5.8+ or 4.13.8+, or rotating security keys immediately.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
craftcms · cms
Related CVEs — craftcms cms

In the same product, most dangerous first.

CVE-2025-32432CRITICALCraft CMS Allows Remote Code ExecutionEPSS 99.8%KEVCVE-2024-56145CRITICALRCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmsEPSS 97.5%KEVCVE-2023-41892CRITICALCraft CMS Remote Code Execution vulnerabilityEPSS 94.2%CVE-2026-32267HIGHCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()EPSS 9.6%CVE-2023-40035HIGHCraft CMS vulnerable to Remote Code Execution via validatePath bypassEPSS 2.3%CVE-2023-32679HIGHRemote Code Execution via unrestricted file extension in Craft CMSEPSS 1.8%