CVE-2025-23209

What it actually does

This vulnerability allows remote code execution in Craft CMS 4 and 5 when an attacker has obtained the application security key. The security key is used to protect signed and encrypted application data; if it is compromised, an attacker can craft trusted-looking payloads that the application accepts and processes, leading to execution of attacker-controlled PHP code or system commands in the context of the web server user. Exploitation can provide full control of the Craft application, its files, database access available to the application, secrets stored in configuration, and any reachable internal services from the web server.

Why it matters to the business

A compromised and unpatched Craft CMS site can be taken over remotely, enabling website defacement, theft of customer or content data, credential and secret harvesting, malware hosting, spam or phishing placement, and lateral movement into connected infrastructure. This issue is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2025-03-13, so exposed systems should be treated as urgent even though exploitation requires prior compromise of the Craft security key. Public-facing CMS platforms are high-value targets because successful exploitation can directly affect brand reputation, availability, and data confidentiality.

How an attack unfolds

An attacker first obtains the Craft security key through a separate weakness such as exposed environment files, leaked backups, source-code disclosure, compromised deployment secrets, prior server access, or insecure CI/CD logs. With that key, the attacker forges application data that Craft trusts because it appears correctly signed or encrypted. The attacker sends the forged payload to a vulnerable Craft 4 or 5 installation over HTTP. The vulnerable application accepts the payload and reaches a code path that results in execution of attacker-controlled PHP behavior or operating-system commands. After gaining execution, the attacker commonly validates access, writes a web shell or persistence file, reads configuration and database credentials, exfiltrates sensitive data, deploys malware, or uses the web server as a foothold for further intrusion. Active exploitation has been observed and is tracked as a Craft CMS code injection vulnerability campaign; ransomware use is not currently indicated in the provided KEV metadata.

How to fix it

Upgrade affected Craft CMS installations immediately. Fixed releases are Craft CMS 5.5.8 and Craft CMS 4.13.8; source deployments should include the upstream fix commit 02c00d5b58683b85c8b4e04bdc66fae1d987a293 or a later trusted commit. Because exploitation depends on a compromised security key, rotate the Craft security key after patching and treat the old key as exposed if there is any uncertainty. Ensure the new key is generated securely, stored only in an appropriate secret manager or protected environment configuration, and not committed to source control, images, backups, or logs. After key rotation, invalidate active sessions and cached signed tokens where feasible, review integrations that depend on application secrets, and rotate any database, API, SMTP, storage, and third-party credentials accessible to the Craft process if compromise is suspected. If immediate upgrade is not possible, rotate the security key, restrict external access to administrative and dynamic endpoints, place the site behind a WAF or access control layer, disable unnecessary plugins, harden file permissions to prevent web-writable PHP where possible, and increase monitoring; these mitigations reduce risk but do not replace patching.

How to confirm the fix worked

Confirm the running Craft CMS version is 5.5.8 or later for version 5 deployments, or 4.13.8 or later for version 4 deployments. For source-based deployments, verify the codebase includes commit 02c00d5b58683b85c8b4e04bdc66fae1d987a293 or a later upstream release. Confirm the Craft security key was rotated after the upgrade and is no longer present in repository history, container image layers, deployment logs, public files, or backup locations. Validate that old sessions or signed artifacts no longer work where applicable. Review file integrity for the Craft installation, especially web-accessible directories, templates, plugins, and configuration files. Confirm web server and PHP logs show no new suspicious requests, PHP errors, unexpected process execution, or file writes after remediation. If a vulnerability scanner is used, it should report Craft CMS as a fixed version and should not find exposed .env files, backup archives, or other files that could disclose the security key.

Typical attack path

1. Identify internet-facing Craft CMS 4 or 5 installations that have not been updated to a fixed release.
2. Acquire or reuse a compromised Craft security key from leaked configuration, exposed backups, repository history, logs, or a previous compromise.
3. Craft signed or encrypted malicious input that the vulnerable application will treat as trusted.
4. Send the malicious request to the Craft CMS application over HTTP or HTTPS.
5. Trigger remote code execution under the web server or PHP runtime account.
6. Run discovery commands, read Craft configuration, and extract database credentials or other secrets.
7. Establish persistence through a web shell, modified plugin/template, scheduled task, malicious PHP file, or backdoor account.
8. Use access for data theft, website modification, malware hosting, credential harvesting, or lateral movement.

How to detect it

Investigate both prerequisite key exposure and post-exploitation activity. Review Craft logs, web server access logs, web server error logs, PHP-FPM logs, system authentication logs, EDR telemetry, file integrity monitoring, repository audit logs, CI/CD logs, container build logs, and secret-management audit trails. Look for requests to Craft endpoints that include unusually large encoded parameters, serialized-looking data, repeated POSTs from unfamiliar IPs, abnormal 400/500 errors followed by successful requests, or requests immediately followed by outbound connections or process execution by the web server user. Hunt for PHP or web server processes spawning shells or network utilities such as sh, bash, curl, wget, python, perl, nc, ncat, openssl, or powershell. Review web-accessible directories and Craft template/plugin directories for recently created or modified PHP files, obfuscated code, base64 decoding, eval/assert usage, or files with image-like names but PHP content. Check for access to configuration files, .env files, backup archives, source control metadata, or deployment artifacts that could have exposed the Craft security key. In Craft application data, review administrative users, plugin installations, templates, queues, scheduled jobs, and project configuration changes for unauthorized modifications. If a known compromised key is identified, treat any vulnerable-period request with valid signed data from untrusted sources as suspicious and rotate related secrets.

• CRAFT_SECURITY_KEY
• securityKey
• /.env
• /.git/config
• /.git/HEAD
• /storage/logs/web.log
• /storage/logs/queue.log
• /config/app.php
• /config/general.php
• /config/db.php
• eval(
• base64_decode(
• shell_exec(
• passthru(
• proc_open(
• popen(
• assert(
• system(
• phpinfo(
• FilesMan
• WSOsetcookie
• c99shell
• r57shell
• php-fpm: pool
• php-fpm
• www-data
• apache
• nginx
• bash -c
• sh -c
• curl
• wget
• /bin/nc
• /bin/bash
• /tmp/
• /var/tmp/
• /dev/shm/
• craftcms/cms
• 02c00d5b58683b85c8b4e04bdc66fae1d987a293

What your security team should do

• Prioritize all internet-facing Craft CMS 4 and 5 instances for immediate upgrade to Craft 5.5.8 or 4.13.8 or later because the vulnerability is in CISA KEV and has active exploitation in the wild.
• Rotate the Craft security key after patching and invalidate active sessions or signed tokens where operationally feasible.
• Search for leaked Craft security keys in source repositories, CI/CD logs, container images, backup archives, web-accessible files, and developer workstations.
• Perform compromise assessment before and after patching, focusing on web shells, modified PHP files, unauthorized plugins, suspicious templates, unexpected admin users, and PHP child processes spawning command-line tools.
• Rotate database and third-party service credentials accessible to Craft if there is evidence the server was exploited or if the security key was confirmed exposed.
• Restrict access to Craft administrative interfaces and sensitive dynamic endpoints using VPN, identity-aware proxy, IP allowlisting, or strong access controls.
• Deploy WAF and logging rules for suspicious signed payload abuse, anomalous POST requests, command execution patterns, and web shell access, but do not rely on WAF controls as the primary fix.
• Preserve logs and forensic artifacts before rebuilding or cleaning systems so active exploitation can be investigated.
• If compromise is confirmed, rebuild affected application hosts from trusted images and redeploy clean application code rather than only deleting visible malicious files.