https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T01:44:59.259539+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-249390 EUVD-2026-249390 2026-10-19T01:44:59.262016+00:00 EUVD-2026-249390 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54417 fkie_cve-2025-54417 2026-10-19T01:44:59.262052+00:00

Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-23209: "Craft CMS has a potential RCE with a compromised security key". To exploit this vulnerability, the project must meet these requirements: have a compromised security key and create an arbitrary file in Craft's /storage/backups folder. With those criteria in place, attackers could create a specific, malicious request to the /updater/restore-db endpoint and execute CLI commands remotely. This issue is fixed in versions 4.16.3 and 5.8.4.

 https://cve.radiocsirt.org/vuln/ghsa-2vcf-qxv3-2mgw GHSA-2vcf-qxv3-2mgw — Craft CMS has a theoretical bypass for CVE-2025-23209 2026-10-19T01:44:59.262087+00:00

Affected: Packagist: craftcms/cms

**Pre-requisites:**

* Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret) * Somehow, manage to create an arbitrary file in Craft’s `/storage/backups` folder.

With those two pieces in place, you could create a specific, malicious request to the `/updater/restore-db` endpoint to execute CLI commands remotely.

Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57

-----

Reported by Marco O. (segfault)