CVE-2025-23209: Craft CMS Remote Code Execution Vulnerability

CVE-2025-23209 Overview

CVE-2025-23209 is a Remote Code Execution (RCE) vulnerability affecting Craft CMS versions 4 and 5. This vulnerability allows attackers to execute arbitrary code on vulnerable Craft CMS installations where the security key has already been compromised. Craft CMS is a flexible, user-friendly content management system designed for creating custom digital experiences on the web and beyond.

The vulnerability requires a pre-existing compromise of the application's security key, which is then leveraged to achieve remote code execution. This makes the attack conditional but highly dangerous once the prerequisite is met, as it grants complete control over the affected system.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation enables attackers to execute arbitrary code on affected Craft CMS installations, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

• Craft CMS version 4.0.0 through 4.13.7
• Craft CMS version 5.0.0 through 5.5.7
• All Craft CMS 4.x and 5.x installations with compromised security keys

Discovery Timeline

• 2025-01-18 - CVE-2025-23209 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2025-23209

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The flaw exists in Craft CMS's handling of requests when combined with a compromised security key, allowing attackers to inject and execute malicious code on the server.

The attack is network-accessible but requires high complexity due to the prerequisite of obtaining the security key. However, once an attacker possesses the security key, they can exploit this vulnerability without any user interaction or special privileges, potentially achieving full confidentiality, integrity, and availability impact on the target system.

Given its inclusion in the CISA Known Exploited Vulnerabilities catalog, organizations should treat this vulnerability as an immediate priority regardless of whether they believe their security key has been compromised.

Root Cause

The root cause stems from insufficient validation and sanitization of input when processing requests that are authenticated using the application's security key. The security key, typically stored in the Craft CMS configuration, is designed to provide cryptographic protection for sensitive operations. However, when this key is compromised, attackers can craft malicious payloads that bypass security controls and achieve code execution.

The vulnerability specifically relates to how the UpdaterController.php component processes incoming requests, allowing code injection when proper file handling safeguards were not in place.

Attack Vector

The attack is conducted over the network and targets Craft CMS installations where the security key has been compromised through other means (e.g., configuration file exposure, repository leakage, or other security incidents). The attacker leverages the compromised key to authenticate malicious requests that result in arbitrary code execution on the server.

Attack prerequisites include:

• Target running a vulnerable version of Craft CMS (4.x before 4.13.8 or 5.x before 5.5.8)
• Attacker has obtained the application's security key
• Network access to the Craft CMS installation

 use Composer\Semver\VersionParser;
 use Craft;
 use craft\errors\InvalidPluginException;
+use craft\helpers\FileHelper;
 use RequirementsChecker;
 use Throwable;
 use yii\web\BadRequestHttpException;

Source: GitHub Security Patch

The patch introduces the FileHelper class to the UpdaterController.php, implementing proper file handling and sanitization to prevent code injection through the vulnerable pathway.

Detection Methods for CVE-2025-23209

Indicators of Compromise

• Unusual HTTP requests targeting Craft CMS update or controller endpoints
• Unexpected process execution spawned from the PHP/web server process
• Modifications to Craft CMS files outside of normal update procedures
• Web server logs showing suspicious POST requests to /admin/ or update-related endpoints
• New or modified files in the Craft CMS installation directory with unexpected content

Detection Strategies

• Monitor web application logs for abnormal requests to Craft CMS administrative endpoints
• Implement file integrity monitoring on Craft CMS installation directories
• Deploy web application firewall (WAF) rules to detect code injection patterns
• Review access logs for requests with unusual parameters targeting update functionality
• Use SentinelOne Singularity to detect and block malicious process execution chains

Monitoring Recommendations

• Enable verbose logging for Craft CMS administrative actions
• Configure alerts for any file modifications within the CMS installation directory
• Monitor for outbound connections from the web server to unexpected destinations
• Implement network segmentation to limit lateral movement if the CMS is compromised
• Review and audit all access to configuration files containing security keys

How to Mitigate CVE-2025-23209

Immediate Actions Required

• Update Craft CMS to version 5.5.8 or 4.13.8 immediately
• Rotate all security keys if there is any suspicion of compromise
• Review access logs for signs of exploitation
• Audit who has access to configuration files containing security keys
• Implement additional monitoring on Craft CMS installations

Patch Information

Craft CMS has released security patches addressing this vulnerability:

• Craft CMS 5.5.8 - Patched version for Craft 5.x installations
• Craft CMS 4.13.8 - Patched version for Craft 4.x installations

The official security advisory is available at the GitHub Security Advisory GHSA-x684-96hh-833x. The specific code changes can be reviewed in the security patch commit.

Workarounds

• If immediate patching is not possible, rotate security keys and ensure their confidentiality
• Restrict network access to Craft CMS administrative interfaces
• Implement web application firewall rules to filter malicious requests
• Remove public access to the administrative panel and require VPN access
• Follow the Craft CMS Security Guide for additional hardening measures

# Rotate Craft CMS security key via CLI
php craft setup/security-key

# After rotation, update the CRAFT_SECURITY_KEY in your .env file
# Ensure the .env file has restrictive permissions
chmod 600 .env

# Verify file permissions on configuration files
ls -la config/.env