Craft CMS Code Injection Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

8.1 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

19.13 %

Predictive Probability

Percentile Rank

95.3 th

Documented as more likely to be exploited than 95.3% of known CVEs.

Detection Date

Feb 20, 2025

Remediation Due

Mar 13, 2025

CISA Catalog Active

Threat Analysis

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-23209