Vulnerability Database
289,496
Total vulnerabilities in the database
CVE-2025-23209
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
| Software | From | Fixed in |
|---|---|---|
craftcms / cms
|
5.0.0-RC1 | 5.5.8 |
|
craftcms / cms
|
4.0.0-RC1 | 4.13.8 |
| craftcms / craft_cms | 4.0.0-rc3 | 4.0.0-rc3.x |
| craftcms / craft_cms | 4.0.0-rc1 | 4.0.0-rc1.x |
| craftcms / craft_cms | 4.0.0-rc2 | 4.0.0-rc2.x |
| craftcms / craft_cms | 4.0.0 | 4.0.0.x |
| craftcms / craft_cms | 5.0.0-rc1 | 5.0.0-rc1.x |
| craftcms / craft_cms | 5.0.0.x | 5.5.8 |
| craftcms / craft_cms | 4.0.0.x | 4.13.8 |
| craftcms / craft_cms | 5.0.0 | 5.0.0.x |