N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54417

CVE-2025-54417: Craft CMS has a theoretical bypass for CVE-2025-23209

Pre-requisites:

Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret)
Somehow, manage to create an arbitrary file in Craft’s /storage/backups folder.

With those two pieces in place, you could create a specific, malicious request to the /updater/restore-db endpoint to execute CLI commands remotely.

Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57

Reported by Marco O. (segfault)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54417

CVE-2025-54417:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 4.13.8, < 4.16.3	4.16.3
craftcms/cms	composer	>= 5.5.8, < 5.8.4	5.8.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows for remote code execution by exploiting the database restore functionality in Craft CMS's updater. The analysis of the provided patch (a19d46be78a9ca1ea474012a10e97bed0d787f57) clearly indicates that the actionRestoreDb method within the UpdaterController.php file is the entry point for this vulnerability. The patch completely removes the logic for restoring a database from this method and instead throws a NotSupportedException. This change, combined with the removal of related calls in actionMigrate and runMigrations, confirms that actionRestoreDb was the vulnerable function. An attacker, having met the prerequisites of a compromised security key and the ability to place a file in the backup directory, could have sent a malicious request to the /updater/restore-db endpoint, which is handled by this function, to trigger the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.