CVE-2025-23209: Craft CMS Code Injection Vulnerability

Vulnerability summary

CVE-2025-23209 is a high (CVSS 8.1) Code Injection vulnerability in Craft CMS. It is known to be exploited: CISA lists it, first on 20-02-2025. EPSS estimates a 21.78% chance of exploitation in the next 30 days, higher than 97.6% of scored vulnerabilities.

Timeline

1. 18-01-2025
   PublishedVulnerability first disclosed.
2. 20-02-2025
   Added to CISA KEVCraft CMS Code Injection Vulnerability
3. 13-03-2025
   CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 26-02-2026
   Last modifiedVulnerability information updated.

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.