Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N H L R C H H H 8.1 .2178 97.6 YES
AFFECTED Product Versions Fixed cms >= 5.0.0-RC1, < 5.5.5 – —
TIMELINE Jan 13 Reserved by GitHub_M Jan 18 Published (CNA: GitHub_M) Feb 20 Added to CISA KEV, remediation due 2025-03-13
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
| Date | Event | Detail |
|---|---|---|
| January 13, 2025 | Reserved | Reserved by GitHub_M |
| January 18, 2025 | Published | Published (CNA: GitHub_M) |
| February 20, 2025 | KEV ADDED | Added to CISA KEV, remediation due 2025-03-13 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| craftcms | cms | — | >= 5.0.0-RC1, < 5.5.5 | — |
Authoritative record: CVE-2025-23209 at cve.org
Vendors: craftcms
Weaknesses: CWE-94
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-23209 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
