{"schema":"threatline.record/2","record":{"id":"CVE-2025-23209","aliases":["GHSA-x684-96hh-833x"],"summary":"Craft CMS Code Injection Vulnerability","details":"Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.","categories":["Applications & CMS"],"product":"Craft CMS","vendor":"Craft CMS","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-23209","source_modified_at":"2026-02-26T19:09:05.707Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"cms","vendor":"craftcms","versions":[{"status":"affected","version":">= 5.0.0-RC1, < 5.5.5"},{"status":"affected","version":">= 4.0.0-RC1, < 4.13.8"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x","source_modified_at":"2025-01-18T00:11:55Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0-RC1, < 5.5.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x","source_modified_at":"2025-01-18T00:11:55Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 4.0.0-RC1, < 4.13.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x684-96hh-833x","source_modified_at":"2025-10-22T19:54:46.578925Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"craftcms/cms","purl":"pkg:composer/craftcms/cms"},"ranges":[{"events":[{"introduced":"5.0.0-RC1"},{"fixed":"5.5.8"}],"type":"ECOSYSTEM"}],"versions":["5.0.0","5.0.0-RC1","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.1.0","5.1.1","5.1.10","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9","5.2.0","5.2.0-beta.1","5.2.0-beta.2","5.2.0-beta.3","5.2.0-beta.4","5.2.0-beta.5","5.2.0-beta.6","5.2.1","5.2.10","5.2.2","5.2.3","5.2.4","5.2.4.1","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","5.3.0","5.3.0-beta.1","5.3.0-beta.2","5.3.0.1","5.3.0.2","5.3.0.3","5.3.1","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.4.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x684-96hh-833x","source_modified_at":"2025-10-22T19:54:46.578925Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"craftcms/cms","purl":"pkg:composer/craftcms/cms"},"ranges":[{"events":[{"introduced":"4.0.0-RC1"},{"fixed":"4.13.8"}],"type":"ECOSYSTEM"}],"versions":["4.0.0","4.0.0-RC1","4.0.0-RC2","4.0.0-RC3","4.0.0.1","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.5.1","4.0.5.2","4.0.6","4.1.0","4.1.0.1","4.1.0.2","4.1.1","4.1.2","4.1.3","4.1.4","4.1.4.1","4.10.0","4.10.0-beta.1","4.10.0-beta.2","4.10.1","4.10.2","4.10.3","4.10.4","4.10.5","4.10.6","4.10.7","4.10.8","4.11.0","4.11.0.1","4.11.0.2","4.11.1","4.11.2","4.11.3","4.11.4","4.11.5","4.12.0","4.12.1","4.12.2","4.12.3","4.12.4","4.12.4.1","4.12.5","4.12.6","4.12.6.1","4.12.7"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x","source_modified_at":"2025-01-18T00:11:55Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.5.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x","source_modified_at":"2025-01-18T00:11:55Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"4.13.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x684-96hh-833x","source_modified_at":"2025-10-22T19:54:46.578925Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"craftcms/cms","purl":"pkg:composer/craftcms/cms"},"version":"5.5.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x684-96hh-833x","source_modified_at":"2025-10-22T19:54:46.578925Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"craftcms/cms","purl":"pkg:composer/craftcms/cms"},"version":"4.13.8"}],"cvss":8.1,"severity":"High","kev":{"listed":true,"date_added":"2025-02-20","due_date":"2025-03-13","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.21776,"percentile":0.97638,"score_date":"2026-10-23"},"published_at":"2025-01-18T00:32:54.954Z","modified_at":"2026-02-26T19:09:05.707Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T19:30:18.9209Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-23209","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-02-26T19:09:05.707Z"},{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x","fetched_at":"2026-10-24T00:31:04.721601Z","source_modified_at":"2025-01-18T00:11:55Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-x684-96hh-833x","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-22T19:54:46.578925Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-23209","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","GitHub Advisory Database","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23209","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23209","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2025-02-21T04:56:13.643788Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-02-26T19:09:05.707Z","content_hash":"778c3c0e856f8918d6e0e8c50c90974d109ccc34f6579a204d9115c09476c72b"}}