MediumGHSA-2vcf-qxv3-2mgwCVE-2025-54417

Craft CMS has a theoretical bypass for CVE-2025-23209

Published 8 Aug 2025 · Updated 11 Aug 2025

Affected packages

craftcms/cmsComposer

Affected: >=4.13.8 <4.16.3
Fixed in: 4.16.3

Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.16.3

craftcms/cmsComposer

Affected: >=5.5.8 <5.8.4
Fixed in: 5.8.4

Update to the fixed version for your release line, for example:composer require craftcms/cms:^5.8.4

Details

Pre-requisites:

Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret)
Somehow, manage to create an arbitrary file in Craft’s /storage/backups folder.

With those two pieces in place, you could create a specific, malicious request to the /updater/restore-db endpoint to execute CLI commands remotely.

Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57

-----

Reported by Marco O. (segfault)

Is GHSA-2vcf-qxv3-2mgw in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.