CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-01-18
Craft CMS Remote Code Execution (RCE) via Compromised Security Key (CVE-2025-23209)
[Affected Scope] Craft CMS 4.x (prior to 4.13.8) and 5.x (prior to 5.5.8) installations where the security key has been compromised
[Impact] Attackers can leverage the compromised security key to forge serialized payloads, leading to arbitrary Remote Code Execution (RCE) on the host server
[Mitigation] Immediately upgrade Craft CMS to version 4.13.8 or 5.5.8 (or higher) and rotate the CRAFT_SECURITY_KEY