CISA KEV · Known exploitedHigh

CVE-2025-23209

Craft CMS

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

CVSS: 8.1
EPSS: 4.36%
CISA KEV: Listed
Published: 2025.01.18

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability4.36%

Technical severityCVSS 8.1

Vulnerability overview

Affected product and versions

Product: Craft CMS
Affected versions: >= 5.0.0-RC1, < 5.5.5, >= 4.0.0-RC1, < 4.13.8, > 4.0.0 < 4.13.8, > 5.0.0 < 5.5.8, 4.0.0, 5.0.0
Fixed versions: 4.13.8, 5.5.8

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Due date: 2025.03.13

1
Identify
Confirm that Craft CMS and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-94
KEV added: 2025.02.20
Ransomware use: 미확인