GHSA-2vcf-qxv3-2mgwmedium5.2
Craft CMS has a theoretical bypass for CVE-2025-23209
Impact
Pre-requisites:
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
craftcms/cms Packagist
| Affected range | Recorded fix |
|---|---|
| From 4.13.8 before 4.16.3Ecosystem versions | 4.16.3 |
| From 5.5.8 before 5.8.4Ecosystem versions | 5.8.4 |
Version evidence: OSV · GHSA-2vcf-qxv3-2mgw
View original version evidence (88 explicit versions)
Original source description
Pre-requisites:
- Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret)
- Somehow, manage to create an arbitrary file in Craft’s
/storage/backupsfolder.
With those two pieces in place, you could create a specific, malicious request to the /updater/restore-db endpoint to execute CLI commands remotely.
Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
Reported by Marco O. (segfault)
References
- Security advisory github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw
- Security advisory nvd.nist.gov/vuln/detail/CVE-2025-23209
- Security advisory nvd.nist.gov/vuln/detail/CVE-2025-54417
- Patch github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
- Source reference github.com/craftcms/cms