~ / search / GHSA-2vcf-qxv3-2mgw

GHSA-2vcf-qxv3-2mgw

Craft CMS has a theoretical bypass for CVE-2025-23209

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-54417

Packages

EcosystemPackageAffectedFixed in
Packagist craftcms/cms >= 4.13.8, < 4.16.3 4.16.3
Packagist craftcms/cms >= 5.5.8, < 5.8.4 5.8.4

Details

As written in the advisory (Markdown source, shown as plain text).

**Pre-requisites:** * Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret) * Somehow, manage to create an arbitrary file in Craft’s `/storage/backups` folder. With those two pieces in place, you could create a specific, malicious request to the `/updater/restore-db` endpoint to execute CLI commands remotely. Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57 ----- Reported by Marco O. (segfault)

References

External links from the advisory. They lead to third-party sites.