GHSA-2vcf-qxv3-2mgwMedium

Craft CMS has a theoretical bypass for CVE-2025-23209

Published
August 8, 2025
Last Modified
August 11, 2025

🔗 CVE IDs covered (1)

CVE-2025-54417 →

📋 Description

Pre-requisites:

  • Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret)
  • Somehow, manage to create an arbitrary file in Craft’s /storage/backups folder.

With those two pieces in place, you could create a specific, malicious request to the /updater/restore-db endpoint to execute CLI commands remotely.

Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57

Reported by Marco O. (segfault)

🎯 Affected products2

  • composer/craftcms/cms:>= 4.13.8, < 4.16.3
  • composer/craftcms/cms:>= 5.5.8, < 5.8.4

🔗 References (5)