CVE-2025-23209 Craft CMS Craft CMS
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
- CVSS
- not scored
On CISA’s exploited list
Craft CMS Code Injection Vulnerability
- Added
- 2025-02-20
- Federal patch deadline
- 2025-03-13
- Ransomware use
- not known