AEGLIX vulnerability intelligence
CVE-2025-23209
HIGH · CVSS 8.0 · Analyzed
Published: 2025-01-18 · Updated: 2026-06-17 · Source: NVD
Vulnerability overview
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
Severity and scoring
- CVSS score
- 8.0 · HIGH
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-94
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Craft CMS · Craft CMS
- Added to catalog
- 2025-02-20
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA remediation due date
- 2025-03-13
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
After (exclusive): 4.0.0
Before (exclusive): 4.13.8
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
After (exclusive): 5.0.0
Before (exclusive): 5.5.8
cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret
Product
- https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603
Patch
- https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x
Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23209
US Government Resource