Potential RCE with a compromised security key in craft/cms
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 5.5.5, 4.13.8, 5.5.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Craft CMS versions 4 and 5 are affected by this vulnerability, which allows remote code execution on websites where the security key has already been compromised. Any unpatched installation with a compromised security key is at risk of an attacker running arbitrary code on the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- craftcms cms
From 5.0.0-RC1 · fixed in 5.5.5; From 4.0.0-RC1 · fixed in 4.13.8
- craftcms/cmsPackagist
From 5.0.0-RC1 · fixed in 5.5.8
- craftcms/cmsPackagist
From 4.0.0-RC1 · fixed in 4.13.8
References 3
GitHub · craftcms/cms
Questions about CVE-2025-23209
What does this mean?
In Craft CMS installs whose security key has already been compromised, this flaw allows remote code execution on the Craft installation. The key is what protects the installation, so the flaw matters most once that key is known to someone else.Source: github.com
Am I affected, and how do I check?
The affected range is Craft 4.0.0-RC1 up to but not including 4.13.8, and Craft 5.0.0-RC1 up to but not including 5.5.5. The advisory says the fix is in Craft 5.5.8 and 4.13.8. To check a Craft install, look at the Craft version in the control panel or run composer show craftcms/cms in the project.Source: github.com
What should I do about it?
Upgrade Craft to 5.5.8 on the 5.x line or to 4.13.8 on the 4.x line. Until the upgrade is done, rotate the security key and keep it private.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-02-20, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data