VulnerabilityAnalyzed

CVE-2025-23209

Craft CMS Code Injection Vulnerability

KEVHIGH 8.1EPSS 21.6%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 13 March 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 21.64% probability · 98th percentile
Public exploits: None in Exploit-DB
CISA KEV: Listed 20 February 2025 · due 13 March 2025
Weakness: CWE-94
Affected: craftcms/craft cms
Source: security-advisories@github.com

EPSS trend

EPSS 21.6% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x ; https://nvd.nist.gov/vuln/detail/CVE-2025-23209

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.