Packagist/craftcms/cms CVE-2025-23209: high 8, exploited, EPSS 21.78%
Craft CMS has a potential RCE with a compromised security key
Action: Upgrade craftcms/cms to 4.13.8 or later.
composer require craftcms/cms:5.5.8composer require craftcms/cms:4.13.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0-RC1 | 5.5.8 | - |
| 4.0.0-RC1 | 4.13.8 | - |
Fixed versions
| 5.5.8 | 4.13.8 |
Sources
- osv: GHSA-x684-96hh-833x
- kev: CVE-2025-23209
- https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x
- https://nvd.nist.gov/vuln/detail/CVE-2025-23209
- https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603
- https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret
- https://github.com/craftcms/cms
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23209
CVE-2025-23209 · published · modified · JSON