CVE-2025-23209
Craft CMS Code Injection Vulnerability
Description
CVE-2025-23209 is a high-severity remote code execution (RCE) vulnerability in Craft CMS versions 4 and 5 that can be exploited when the application's security key has already been compromised. Rated with a CVSS v3.1 base score of 8.0, this vulnerability affects Craft CMS versions prior to 5.5.8 and 4.13.8. CISA has added CVE-2025-23209 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 13, 2025, confirming active exploitation in the wild. The EPSS score of 19.13% at the 95.2nd percentile indicates a very high likelihood of exploitation, making immediate patching essential for all Craft CMS installations where the security key may have been exposed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| craftcms | craft cms | > 4.0.0, < 4.13.8; > 5.0.0, < 5.5.8; 4.0.0; 5.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret(Product)
- https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603(Patch)
- https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23209(US Government Resource)
Weakness Type
Code Injection / Insecure Deserialization with Compromised Key
CVE-2025-23209 stems from a vulnerability that enables remote code execution in Craft CMS when the application's security key has been compromised. The security key in Craft CMS is used for cryptographic operations including session management, data encryption, and object serialization. When an attacker possesses the security key, they can forge or manipulate cryptographically signed data that Craft CMS trusts, leading to code execution through deserialization or template injection pathways. This represents a critical trust boundary violation where the compromise of a single secret enables full application takeover.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2025-23209 presents a critical risk to organizations running Craft CMS with a compromised security key. The vulnerability is exploitable over the network (AV:N) but with high attack complexity (AC:H) since it requires the attacker to have already obtained the application's security key. It requires low privileges (PR:L) and user interaction (UI:R), with a changed scope (S:C) indicating impact beyond the vulnerable component. Confidentiality (High): Successful remote code execution grants the attacker full access to all data managed by Craft CMS, including content databases, user credentials, API keys, configuration files, and any sensitive business data stored in the CMS. The changed scope means the attacker could pivot to access resources on the underlying server. Integrity (High): An attacker can modify website content, inject malicious scripts into pages served to visitors, alter user accounts and permissions, and plant persistent backdoors in the application code. Availability (High): Full code execution allows the attacker to shut down the CMS, corrupt databases, encrypt files, or render the entire website inoperable. The EPSS score of 19.13% at the 95.2nd percentile confirms high exploitation activity, and the ransomware status is listed as Unknown, though the RCE capability makes affected systems viable targets for ransomware deployment.
Exploit Maturity
CVE-2025-23209 demonstrates confirmed exploit maturity with active exploitation in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 13, 2025, confirming real-world exploitation. The Craft CMS team has published a security advisory (GHSA-x684-96hh-833x) detailing the vulnerability and providing patched versions. A commit fixing the vulnerability is publicly available, giving security researchers and potential attackers insight into the technical details. The EPSS score of 19.13% at the 95.2nd percentile places this vulnerability in the top 5% for exploitation probability. The ransomware use status is listed as Unknown by CISA. Craft CMS has also published guidance on securing your Craft installation, emphasizing the importance of keeping security keys confidential.
Remediation
-
Update Craft CMS immediately. Upgrade to Craft CMS 5.5.8 or later (for Craft 5) or Craft CMS 4.13.8 or later (for Craft 4). These versions contain the patch that addresses the remote code execution vulnerability. Follow the official upgrade guide for detailed instructions.
-
Rotate your security key. If there is any possibility that your Craft CMS security key has been compromised, generate a new security key immediately. Follow the guidance in Craft CMS knowledge base on securing secrets. After rotation, all existing sessions will be invalidated and encrypted data will need to be re-encrypted.
-
Audit for signs of compromise. Review server access logs, Craft CMS activity logs, and file modification timestamps for any evidence of unauthorized code execution. Look for unfamiliar files, modified templates, unexpected user accounts, and suspicious outbound network connections from the server.
-
Secure the security key storage. Ensure the security key is stored in environment variables or a secrets manager rather than in configuration files that could be exposed through version control, backup files, or directory traversal vulnerabilities. Restrict file system permissions so that only the web server process can read the key.
-
Implement defense-in-depth measures. Deploy a web application firewall (WAF) in front of Craft CMS, enable file integrity monitoring to detect unauthorized changes, and configure the web server to run with minimum necessary privileges. Regularly audit third-party plugins and dependencies for additional vulnerabilities.
Technical Details
CVE-2025-23209 is a remote code execution vulnerability in Craft CMS affecting versions 4.0.0 through 4.13.7 and 5.0.0 through 5.5.7. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H reveals the following characteristics: Attack Vector (Network): The vulnerability is exploitable remotely through the Craft CMS web interface. Attack Complexity (High): Exploitation requires the attacker to have already compromised the application's security key, which adds a prerequisite step that increases overall attack complexity. Privileges Required (Low): A basic authenticated account is needed in addition to the compromised key. User Interaction (Required): Some user interaction is necessary to complete the exploitation chain. Scope (Changed): The exploitation impact extends beyond the Craft CMS application to affect the underlying server and its resources. Impact (High across all dimensions): Successful exploitation achieves full remote code execution with the privileges of the web server process. The underlying vulnerability relates to how Craft CMS uses its security key for cryptographic operations. The security key is central to data signing, session management, and secure serialization within the framework. When an attacker possesses this key, they can craft specially constructed payloads that bypass integrity verification checks, leading to code execution through the deserialization pipeline. The fix commit addresses the vulnerability by strengthening the validation of cryptographically signed data and preventing exploitation even when the security key is known to the attacker.
Frequently Asked Questions
Is CVE-2025-23209 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2025-23209 in the Known Exploited Vulnerabilities catalog with a remediation deadline of March 13, 2025. The EPSS score of 19.13% at the 95.2nd percentile further confirms high exploitation activity.
Does CVE-2025-23209 affect all Craft CMS installations?
CVE-2025-23209 affects Craft CMS versions 4.0.0 through 4.13.7 and 5.0.0 through 5.5.7, but only when the application's security key has been compromised. If your security key has never been exposed, the risk is significantly reduced, though updating is still strongly recommended.
How do I know if my security key is compromised?
Your security key may be compromised if it was ever committed to a public repository, stored in an unprotected configuration file accessible via the web, exposed through a directory traversal vulnerability, or shared through insecure channels. If in doubt, rotate the key and update to the patched version.
How do I fix CVE-2025-23209?
Update Craft CMS to version 5.5.8 or later (Craft 5) or version 4.13.8 or later (Craft 4). Additionally, rotate your security key if there is any possibility it has been compromised, and audit your installation for signs of prior exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.