Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
CISA KEV · ACTIVELY EXPLOITED
HIGH severity

Craft CMS has a potential RCE with a compromised security keyGHSA-x684-96hh-833x

HIGHFix: craftcms/cms@e59e22b

GHSA-x684-96hh-833x is a high-severity (CVSS 8) Code Injection vulnerability in craftcms/cms. It is in CISA's Known Exploited Vulnerabilities catalog (added 2025-02-20) — treat it as actively exploited and patch now. A fix is available for craftcms/cms — see the affected versions and patch details below.

Also known asCVE-2025-23209
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2025-02-20. Federal agencies were required to remediate by 2025-03-13.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for GHSA-x684-96hh-833x.

EPSS Exploitation Probability

via FIRST.org ↗
21.8%probability of exploitation in next 30 days
Moderate Risk0.00%
Lower risk than most CVEs98th percentile — riskier than 98% of all scored CVEsHighest risk
0.00%9.00%18.0%27.0%17.4%21.8%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-x684-96hh-833x by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the 10–50% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected
🐘craftcms/cms🐘craftcms/cms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

This is an RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised.

https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret

Anyone running an unpatched version of Craft with a compromised security key is affected.

Patches

This has been patched in Craft 5.5.8 and 4.13.8.

Workarounds

If you can't update to a patched version, then rotating your security key and ensuring its privacy will help to migitgate the issue.

References

https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistcraftcms/cms≥ 5.0.0-RC1&&< 5.5.85.5.8composer require craftcms/cms:^5.5.8
🐘Packagistcraftcms/cms≥ 4.0.0-RC1&&< 4.13.84.13.8composer require craftcms/cms:^4.13.8

Affected Products

1 product · 8 configurations
Application
craft cmscraftcms
> 5.0.0 && < 5.5.8
2 versions
4.0.05.0.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update craftcms/cms to 5.5.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-x684-96hh-833x is resolved across your whole dependency graph.

  3. Workarounds

    Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

Frequently Asked Questions

### Impact This is an RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret Anyone running an unpatched version of Craft with a compromised security key is affected. ### Patches This has been patched in Craft 5.5.8 and 4.13.8. ### Workarounds If you can't update to a patched version, then rotating your security key and ensuring its privacy will help to migitgate the issue. ### References https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bc
O3 Security · Impact-Aware SCA

Is GHSA-x684-96hh-833x in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Craft CMS has a potential RCE with a compromised…