# CVE-2025-23209

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

- Page: https://www.vulneraibility.com/cve/CVE-2025-23209
- CVSS: 8.0
- Known exploited: yes, in CISA KEV since 2025-02-20; CISA due date 2025-03-13
- EPSS: 21.64%
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-21)
- Weakness: CWE-94
- Also known as: GHSA-x684-96hh-833x
- Published: 2025-01-18

## Affected versions

- craftcms cms: affected >= 5.0.0-RC1 and < 5.5.5; >= 4.0.0-RC1 and < 4.13.8

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x
- [other] https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603
- [other] https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23209

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.