{"cvss":8.1,"datePublished":"2025-02-20","dateUpdated":"2025-02-20","description":"Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.","dueDate":"2025-03-13","id":"CVE-2025-23209","kev_catalogs":["cisa"],"knownRansomwareCampaignUse":"Unknown","notes":"https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x ; https://nvd.nist.gov/vuln/detail/CVE-2025-23209","product":"Craft CMS","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","severity":"HIGH","source":"cisa_known_exploited","title":"Craft CMS Code Injection Vulnerability","vendor":"Craft CMS"}