Craft CMS has a potential RCE with a compromised security key

高 8.1悪用確認済み（CISA KEV）CVE-2025-23209 · GHSA-x684-96hh-833x · 18/01/2025 公開 · 17/06/2026 更新

Craft CMS Code Injection Vulnerability. 悪用が確認されています：CISA は 20/02/2025 にこの脆弱性を「既知の悪用された脆弱性（KEV）」カタログに追加しました。影響を受けるシステムは緊急に修正してください。

要点

CVE-2025-23209 は craftcms/cms, craft cms (craftcms) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
実際に悪用されています：CISA が 20/02/2025 に KEV カタログへ追加しました。
今後30日間に悪用される確率（EPSS）：21.6%（全脆弱性の 97.6% より高い）。
対処：4.13.8, 5.5.8 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
craftcms/cms Packagist	`≥ 4.0.0-RC1, < 4.13.8≥ 5.0.0-RC1, < 5.5.8`	`4.13.85.5.8`
craft cms craftcms	`= 4.0.0= 5.0.0> 4.0.0, < 4.13.8> 5.0.0, < 5.5.8`	`4.13.85.5.8`

概要

Impact

This is an RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised.

https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret

Anyone running an unpatched version of Craft with a compromised security key is affected.

Patches

This has been patched in Craft 5.5.8 and 4.13.8.

Workarounds

If you can't update to a patched version, then rotating your security key and ensuring its privacy will help to migitgate the issue.

References

https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603

NVD の説明

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.