CVE-2025-23209

CVSS 3.1 Score 8 of 10 (high)

Details

Published Jan 18, 2025

CWE ID 94

Summary

CVE-2025-23209 is a remote code execution (RCE) vulnerability affecting Craft CMS versions 4 and 5. The issue arises when a security key, which helps secure installations, has already been compromised. Unpatched Craft installations with compromised security keys are at risk, making it crucial for users to apply the patches immediately. Craft CMS versions 5.5.8 and 4.13.8 contain the necessary fixes. For users unable to update, rotating their security keys and maintaining privacy is advised as temporary measures.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Affected Vendors

Pluck -

Advisories, Assessments, and Mitigations

https://app.recordedfuture.com/live/sc/entity/2cFVx-
https://www.cve.org/CVERecord?id=CVE-2025-23209
https://nvd.nist.gov/vuln/detail/CVE-2025-23209

Back to Vulnerability Database

Platform Features

Products

Use Cases

Teams

Industries

Services

Russia-Aligned TAG-110 Targets Tajikistan with Macro-Enabled Word Documents

Measuring the US-China AI Gap

TerraStealerV2 and TerraLogger: Golden Chickens' New Malware Families Discovered

Know What Matters

For Customers

For Partners