Firetruck

CVE-2025-23209

KEV
Updated Feb 26, 2026 · PUBLISHED
View KEV entry →

Description

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

Full record on cve.org →

Affected packages

PackageVendor / ProductVersion rangeStatus
cmscraftcms / cms>= 4.0.0-RC1, < 4.13.8affected
cmscraftcms / cms>= 5.0.0-RC1, < 5.5.5affected