CVE Watch—

CVE-2025-23209

Craft CMS Code Injection Vulnerability

CVSS

—

Sin CVSS

EPSS

21.8%

p98

KEV

SÍ

20 feb 2025

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

21.8%EPSS · 30 días21.8%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Craft CMS / Craft CMS

Vulnerabilidad

Craft CMS Code Injection Vulnerability

Añadido a KEV

20 feb 2025

Remediar antes de

13 mar 2025

Uso conocido en ransomware

Descripción resumida

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

Acción requerida

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x ; https://nvd.nist.gov/vuln/detail/CVE-2025-23209

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-3243210.0 CRÍ

100.0%

KEV—80Craft CMS Code Injection Vulnerability21d CVE-2024-56145—

99.9%

KEV—80Craft CMS Code Injection Vulnerability—CVE-2025-35939—

70.9%

KEV—71Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability—