CyberzSOC

Applicability
← Back to CVE-2025-23209

CVE-2025-23209

In CISA KEV Craft CMS

Every applicability statement published about this vulnerability, kept as each source wrote it rather than merged into one verdict. Where sources disagree, both positions are shown.

Does it affect your version?

A statement that names no version covers the whole product, which is not the same as your version falling inside a range. Orderings marked best effort come from schemes with no published comparison algorithm; exact ones follow a published specification.

What each source says

OSV.dev (incl. GHSA)
precedence 80 · revised 2026-08-12
5 affected 4 fixed
CVE List v5 (CNA container)
precedence 60 · revised 2026-02-26
2 affected

Precedence decides which claim wins when two sources describe the same product over the same version range. It is a property of the source, not of the claim, and changing it re-ranks the data without re-reading a single document.

Statements (11)

Product Status Versions Remediation Source
craftcms/cms affected >= 5.0.0-RC1, < 5.5.8 vendor fix → 5.5.8 osv GHSA-x684-96hh-833x
craftcms/cms affected >= 4.0.0-RC1, < 4.13.8 vendor fix → 4.13.8 osv GHSA-x684-96hh-833x
https://github.com/craftcms/cms affected >= 04755d93f86d07cc183db47db8a0eee106892e30, < 02c00d5b58683b85c8b4e04bdc66fae1d987a293 vendor fix → 02c00d5b58683b85c8b4e04bdc66fae1d987a293 osv
https://github.com/craftcms/cms affected >= daac7c1da2f701f2e9ddee1da1457ce61660b581, < 5a47f8acc15201e95063b34b0c3cc4d81b202493 vendor fix → 5a47f8acc15201e95063b34b0c3cc4d81b202493 osv
https://github.com/craftcms/cms affected >= a31f7d211b52d55d274c66a291310ceec64c733f, <= a31f7d211b52d55d274c66a291310ceec64c733f none available osv
craftcms/cms fixed 5.5.8 vendor fix → 5.5.8 osv GHSA-x684-96hh-833x
craftcms/cms fixed 4.13.8 vendor fix → 4.13.8 osv GHSA-x684-96hh-833x
https://github.com/craftcms/cms fixed 02c00d5b58683b85c8b4e04bdc66fae1d987a293 vendor fix → 02c00d5b58683b85c8b4e04bdc66fae1d987a293 osv
https://github.com/craftcms/cms fixed 5a47f8acc15201e95063b34b0c3cc4d81b202493 vendor fix → 5a47f8acc15201e95063b34b0c3cc4d81b202493 osv
craftcms/cms craftcms · cms affected >= 5.0.0-RC1, < 5.5.5 none available cve_cna
craftcms/cms craftcms · cms affected >= 4.0.0-RC1, < 4.13.8 none available cve_cna

A claim with no version range is shown as written rather than expanded: a government catalog naming only a vendor and product is a real statement at zero granularity, and inventing bounds for it would put precision in the record that the source never offered.