CISA flags Craft CMS code injection flaw as exploited in attacks

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) warns that a Craft CMS remote code execution flaw is being exploited in attacks.

The flaw is tracked as CVE-2025-23209 and is a high severity (CVSS v3 score: 8.0)  code injection (RCE) vulnerability impacting Craft CMS versions 4 and 5.

Craft CMS is a content management system (CMS) used for building websites and custom digital experiences. 

Not many technical details about CVE-2025-23209 are available, but exploitation isn't easy, as it requires the installation's security key to have already been compromised.

In Craft CMS, the security key is a cryptographic key that secures user authentication tokens, session cookies, database values, and sensitive application data.

The CVE-2025-23209 vulnerability only becomes an issue if an attacker has already obtained this security key, which opens the way to decrypt sensitive data, generate fake authentication tokens, or inject and execute malicious code remotely.

CISA has added the flaw to KEV without sharing any information about the scope and origin of the attacks and who the targets are.

Federal agencies have until March 13, 2025, to patch the Craft CMS flaw.

The flaw has been patched in Craft version 5.5.8 and 4.13.8, so users are recommended to upgrade to those releases or later as soon as possible.

If you suspect compromise, it is recommended that you delete old keys contained in '.env' files and generate new ones using php craft setup/security-key command. Note that key changes render any data encrypted with a previous key inaccessible.

Along with CVE-2025-23209, CISA also added a vulnerability in Palo Alto Networks firewalls (CVE-2025-0111) to the Known Exploited Vulnerability catalog, setting the same deadline for March 13.

This is a file read vulnerability impacting PAN-OS firewalls, which the vendor disclosed is exploited by hackers as part of an exploit chain with CVE-2025-0108 and CVE-2024-9474.

For the PAN-OS versions that address this flaw, impacted users can check out Palo Alto Networks' security bulletin.