Craft CMS Remote Code Execution via Database Backup Path (CVE-2025-23209)

Historical catalog analysis: CISA added this entry on February 20, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-23209 is a code injection vulnerability (CWE-94) identified in Craft CMS. The flaw stems from improper validation of the database backup path, which can be leveraged by an attacker to achieve remote code execution (RCE). This vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog on February 20, 2025.

Exposure and applicability

This vulnerability affects organizations deploying Craft CMS. The primary exposure path is the database backup mechanism; specifically, the lack of rigorous validation for the paths used during these operations allows for the injection of malicious code. Infrastructure owners should prioritize assets where Craft CMS is exposed to untrusted input or managed by accounts with permissions that could influence backup configurations.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize the following actions:

1. Asset Identification: Immediately identify all instances of Craft CMS within the environment to determine the scope of exposure.
2. Vendor Mitigation Application: Apply the specific mitigations provided in the vendor’s security instructions. If the vendor has not provided a viable mitigation for a specific deployment scenario, our analysis suggests evaluating whether to discontinue use of the product until a fix is available.
3. Privilege Review: As a compensating control to limit potential damage, review and restrict permissions associated with database backup operations to ensure only authorized administrative roles can modify these paths.

How to validate remediation

Verification must go beyond a simple version check or the presence of a patch. To assure that exposure has been reduced, defenders should:

• Verify Configuration: Confirm that the specific configuration changes mandated by the vendor’s instructions are active and enforced across all affected instances.
• Validate Input Handling: Where possible in a staging environment, verify that the database backup path no longer accepts invalid or malicious input patterns as described in the vulnerability report.

Confirmation of remediation is achieved when the specific path-validation failure is neutralized, not merely when a software update is installed.

Limits and open questions

While CISA has cataloged this vulnerability, it remains unknown whether this flaw has been utilized by known ransomware campaigns. Additionally, while federal agencies have a mandated deadline of March 13, 2025, for remediation, non-federal organizations must determine their own priority based on their specific risk profile. Residual risk remains if the vendor’s mitigations are applied inconsistently across distributed environments or if underlying system permissions allow for bypasses of the application-level fix.

Source and editorial note

CVE-2025-23209: Craft CMS Code Injection Vulnerability · Source date: February 20, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 23, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 24, 2026 at 00:14 UTC.

Request a Vulnerability Assessment