{"action":"Upgrade craftcms/cms to 4.16.3 or later.","affected":[{"fixed":"4.16.3","introduced":"4.13.8"},{"fixed":"5.8.4","introduced":"5.5.8"}],"component":"craftcms/cms","cve_ids":["CVE-2025-54417"],"ecosystem":"Packagist","epss":0.0053,"exploited":false,"fixed_versions":["4.16.3","5.8.4"],"ghsa_id":"GHSA-2vcf-qxv3-2mgw","id":"tcs_01M5KES9RJPHD1NE6NKD2QNXQG","modified_at":"2025-08-11T14:33:27.150148Z","published_at":"2025-08-08T19:32:50Z","references":["https://osv.dev/vulnerability/GHSA-2vcf-qxv3-2mgw","https://github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw","https://nvd.nist.gov/vuln/detail/CVE-2025-23209","https://nvd.nist.gov/vuln/detail/CVE-2025-54417","https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57","https://github.com/craftcms/cms"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-2vcf-qxv3-2mgw","url":"https://osv.dev/vulnerability/GHSA-2vcf-qxv3-2mgw"},{"source":"nvd","source_id":"CVE-2025-54417","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54417"}],"summary":"Craft CMS has a theoretical bypass for CVE-2025-23209"}