Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-dbcz-erbe-u7dt
Vulnerability ID VCID-dbcz-erbe-u7dt
Aliases CVE-2025-54417
GHSA-2vcf-qxv3-2mgw
Summary Craft CMS has a theoretical bypass for CVE-2025-23209 **Pre-requisites:** * Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret) * Somehow, manage to create an arbitrary file in Craft’s `/storage/backups` folder. With those two pieces in place, you could create a specific, malicious request to the `/updater/restore-db` endpoint to execute CLI commands remotely. Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57 ----- Reported by Marco O. (segfault)
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2025-54417
cvssv4 5.2 https://github.com/craftcms/cms
generic_textual MODERATE https://github.com/craftcms/cms
cvssv4 5.2 https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
generic_textual MODERATE https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
ssvc Track https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
cvssv4 5.2 https://github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw
generic_textual MODERATE https://github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw
ssvc Track https://github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw
cvssv4 5.2 https://nvd.nist.gov/vuln/detail/CVE-2025-23209
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-23209
cvssv4 5.2 https://nvd.nist.gov/vuln/detail/CVE-2025-54417
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-54417
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-54417
https://github.com/craftcms/cms
https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
CVE-2025-23209 https://nvd.nist.gov/vuln/detail/CVE-2025-23209
CVE-2025-54417 https://nvd.nist.gov/vuln/detail/CVE-2025-54417
GHSA-2vcf-qxv3-2mgw https://github.com/advisories/GHSA-2vcf-qxv3-2mgw
GHSA-2vcf-qxv3-2mgw https://github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-11T13:38:12Z/ Found at https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-11T13:38:12Z/ Found at https://github.com/craftcms/cms/security/advisories/GHSA-2vcf-qxv3-2mgw
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U Found at https://nvd.nist.gov/vuln/detail/CVE-2025-23209
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U Found at https://nvd.nist.gov/vuln/detail/CVE-2025-54417
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.4454
EPSS Score 0.00219
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:24:33.905623+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/craftcms/cms/CVE-2025-54417.yml 38.6.0