The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a high-severity security vulnerability in the Craft Content Management System (CMS). The flaw, designated as CVE-2025-23209 with a CVSS score of 8.1, affects Craft CMS versions 4 and 5, potentially allowing remote code execution through compromised user security keys.

Affected Versions:
– Craft CMS 5.0.0-RC1 to 5.5.5
– Craft CMS 4.0.0-RC1 to 4.13.8

Security Patches:
– Version 4.13.8
– Version 5.5.8

The vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. Federal Civilian Executive Branch agencies are required to implement security patches by March 13, 2025.

Mitigation Steps:
1. Update to the latest patched version
2. If immediate updating isn’t possible, rotate security keys
3. Ensure security key privacy

Additionally, Craft CMS reported another security flaw (CVE-2024-56145) in December 2024, which could lead to remote code execution when PHP register_argc_argv configuration is enabled. This vulnerability is currently pending addition to CISA’s KEV catalog.