CVE Watch—

CVE-2025-23209

Craft CMS Code Injection Vulnerability

CVSS

—

Sin CVSS

EPSS

4.7%

p91

KEV

SÍ

20 feb 2025

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

4.7%EPSS · 30 días4.7%

2026-06-302026-07-16

Ficha del catálogo KEV

Producto

Craft CMS / Craft CMS

Vulnerabilidad

Craft CMS Code Injection Vulnerability

Añadido a KEV

20 feb 2025

Remediar antes de

13 mar 2025

Uso conocido en ransomware

Descripción resumida

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

Acción requerida

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x ; https://nvd.nist.gov/vuln/detail/CVE-2025-23209

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-32432—

100.0%

KEV—80Craft CMS Code Injection Vulnerability—CVE-2024-56145—

99.9%

KEV—80Craft CMS Code Injection Vulnerability—CVE-2025-35939—

64.0%

KEV—69Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability—