CVE Watch—

CVE-2025-23209

Craft CMS Code Injection Vulnerability

CVSS

—

No CVSS

EPSS

21.8%

p98

KEV

YES

Feb 20, 2025

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

21.8%EPSS · 30 days21.8%

2026-09-162026-10-14

KEV catalog record

Product

Craft CMS / Craft CMS

Vulnerability

Craft CMS Code Injection Vulnerability

Added to KEV

Feb 20, 2025

Remediate by

Mar 13, 2025

Known ransomware use

Summary description

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x ; https://nvd.nist.gov/vuln/detail/CVE-2025-23209

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-3243210.0 CRI

100.0%

KEV—80Craft CMS Code Injection Vulnerability21d CVE-2024-56145—

99.9%

KEV—80Craft CMS Code Injection Vulnerability—CVE-2025-35939—

70.9%

KEV—71Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability—