CVE-2025-23209

HighCVSS 8.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jan 18, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 20, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-23216.5A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown CVE-2025-232104.8phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass CVE-2025-232119.9Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any CVE-2025-232126.5Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any CVE-2025-232135.4Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to uploa CVE-2025-232146.9Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By CVE-2025-232159.3PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in ja CVE-2025-232166.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret valu CVE-2025-232178.2mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based in CVE-2025-232189.8WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was i CVE-2025-232199.8WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was i CVE-2025-23229.8A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part o