Craft CMS Remote Code Execution (RCE) via Compromised Security Key (CVE-2025-23209)
Executive & SecOps Summary
SECOPS ASSESSMENTCraft CMS 4.x (prior to 4.13.8) and 5.x (prior to 5.5.8) installations where the security key has been compromised
Attackers can leverage the compromised security key to forge serialized payloads, leading to arbitrary Remote Code Execution (RCE) on the host server
Immediately upgrade Craft CMS to version 4.13.8 or 5.5.8 (or higher) and rotate the CRAFT_SECURITY_KEY
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Use Composer to update Craft CMS to the patched versions (4.13.8 or 5.5.8 and above).
# Upgrade Craft CMS 5.x to the latest secure version
composer update craftcms/cms --with-dependencies
# Or force update to the specific patched version
composer require 'craftcms/cms:5.5.8' --update-with-dependencies2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not possible, you must rotate the compromised security key immediately to invalidate any forged payloads. Additionally, restrict access to sensitive configuration files.
# 1. Generate and apply a new security key using Craft CLI
php craft setup/security-key
# 2. Restrict access to .env files in Nginx configuration
# /etc/nginx/conf.d/craft.conf
location ~ /\.(env|log|git) {
deny all;
return 404;
}3. Log Audit & IoC Verification Commands
Verify the running version of Craft CMS and inspect logs for potential exploitation attempts.
# Check the installed Craft CMS version
php craft help | grep -i 'Craft'
# Verify .env file permissions (should be restricted to 600 or 640)
ls -la .env
# Scan web server access logs for suspicious serialized payloads in POST requests
grep -E 'POST .*(actions|index\.php)' /var/log/nginx/access.log | grep -E '(O:[0-9]+|a:[0-9]+)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-23209) is a critical Remote Code Execution (RCE) flaw in Craft CMS that manifests when the application's 'Security Key' (CRAFT_SECURITY_KEY) is compromised. Craft CMS relies on this key to sign and validate serialized data, tokens, and state information. Due to insufficient input validation during deserialization processes (CWE-94), an attacker possessing the key can forge validly signed malicious payloads that the application trusts and executes.
2. Exploitation Mechanics & Attack Scenario
An attacker first obtains the CRAFT_SECURITY_KEY, typically via exposed .env files, public GitHub repositories, or other information disclosure vectors. Using this key, the attacker crafts a serialized PHP object payload containing malicious system commands and signs it using the compromised key. When this payload is sent to a vulnerable endpoint, the application validates the signature successfully, deserializes the payload, and triggers arbitrary code execution under the context of the web server process. This vulnerability is actively exploited in the wild and is listed in CISA's KEV catalog.
3. Infrastructure & Business Impact
Successful exploitation grants the attacker full control over the web application server. This can lead to complete database compromise, exfiltration of sensitive customer data, deployment of web shells, lateral movement within the cloud infrastructure, and potential ransomware deployment.
Official Vendor Advisories & References
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
Frequently Asked SecOps Questions (CVE-2025-23209)
FAQQ1. How critical is CVE-2025-23209 and is it actively exploited in the wild?
CVE-2025-23209 is rated CVSS 8.1 (HIGH) with a 30-day EPSS exploitation probability of 21.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-23209?
Primary impacted vendors include craftcms across craft_cms. Scope summary: Craft CMS 4.x before 4.13.8, and Craft CMS 5.x before 5.5.8, specifically when the security key is exposed or compromised
Q3. What temporary mitigations or workarounds exist for CVE-2025-23209 before patching?
[Mitigation] Immediately upgrade Craft CMS to version 4.13.8 or 5.5.8 (or higher) and rotate the CRAFT_SECURITY_KEY Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-23209
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (craftcms)
View Category →IBM Langflow OSS Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-9198)
[Affected Scope] IBM Langflow OSS versions 1.0.0 through 1.10.0 in default deployments
Langflow Unauthenticated Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-33017)
[Affected Scope] Langflow versions prior to 1.9.0
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-65660)
[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.