CVE-2025-54417 json
Craft contains a theoretical bypass for CVE-2025-23209
published last yr. modified 4mo ago also EUVD-2025-24040 , GHSA-2vcf-qxv3-2mgw
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-23209: "Craft CMS has a potential RCE with a compromised security key". To exploit this vulnerability, the project must meet these requirements: have a compromised security key and create an arbitrary file in Craft's /storage/backups folder. With those criteria in place, attackers could create a specific, malicious request to the /updater/restore-db endpoint and execute CLI commands remotely. This issue is fixed in versions 4.16.3 and 5.8.4.
Patch / fix
- packagist craftcms/cms 4.16.3, 5.8.4
- craftcms craft_cms 4.16.3, 5.8.4
Is CVE-2025-54417 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
| CNA | 4.0 | 5.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/cms | >=4.13.8, <4.16.3 >=5.5.8, <5.8.4 |
4.16.3 5.8.4 |
Affected products
- craftcms cms
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
web, patch
-
github.com
/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-23209
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-54417
advisory
-
github.com
/craftcms/cms
package
Sources
- CVE List CVE-2025-54417
- GitHub Advisory GHSA-2vcf-qxv3-2mgw
- NVD CVE-2025-54417
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.