CVE-2025-54417
BaseFortify
Publication date: 2025-08-09
Last updated on: 2025-09-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| craftcms | craft_cms | From 4.13.8 (inc) to 4.16.3 (exc) |
| craftcms | craft_cms | From 5.5.8 (inc) to 5.8.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Craft CMS versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3. It allows an attacker who has already compromised the security key and can create an arbitrary file in the /storage/backups folder to bypass a previous vulnerability (CVE-2025-23209). By sending a specially crafted request to the /updater/restore-db endpoint, the attacker can execute command line interface (CLI) commands remotely on the server. This can lead to remote code execution (RCE). The issue is fixed in versions 4.16.3 and 5.8.4.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to execute arbitrary commands on the server hosting the Craft CMS application. This can lead to unauthorized access, data theft, data manipulation, service disruption, or full system compromise depending on the attacker's intent and the server environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade Craft CMS to version 4.16.3 or later, or 5.8.4 or later, where the issue is fixed. Additionally, ensure that your security keys are not compromised and avoid allowing arbitrary file creation in the /storage/backups folder.