Code Injection (CVE‑2025‑23209) in Craft CMS Allows Remote Code Execution
What It Is — Craft CMS contains a code‑injection flaw caused by improper validation of the database‑backup path, allowing an attacker to inject arbitrary PHP code.
Exploitability — Publicly disclosed; proof‑of‑concept code is available; CVSS not yet published but the remote‑code‑execution potential classifies it as high severity.
Affected Products — All Craft CMS versions released before the vendor’s corrective update (the patch is expected in the next security release).
Why It Matters for Trust & Control Assurance
- Highlights a concrete control gap in input validation that must be mapped to your control framework (e.g., NIST CSF) to prove secure development practices.
- Without documented, continuously‑monitored validation controls, audit evidence is weak and trust signals to partners or regulators erode.
- Demonstrates the need for a continuous control‑mapping capability that can capture remediation evidence and keep your Trust Center up‑to‑date.
Recommended Actions
- Deploy the vendor‑released patch immediately; if a patch is not yet available, block the backup endpoint at the network perimeter.
- Conduct a focused code review to verify proper sanitization of file‑system paths and add static‑analysis rules for similar patterns.
- Map the input‑validation control to your framework of record and record remediation evidence in a Trust Center repository for audit readiness.
Source: CISA KEV – CVE‑2025‑23209