漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Craft contains a theoretical bypass for CVE-2025-23209
Vulnerability Description
Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-23209: "Craft CMS has a potential RCE with a compromised security key". To exploit this vulnerability, the project must meet these requirements: have a compromised security key and create an arbitrary file in Craft's /storage/backups folder. With those criteria in place, attackers could create a specific, malicious request to the /updater/restore-db endpoint and execute CLI commands remotely. This issue is fixed in versions 4.16.3 and 5.8.4.
CVSS Information
N/A
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Vulnerability Title
Craft CMS 代码注入漏洞
Vulnerability Description
Craft CMS是Craft CMS开源的一套内容管理系统（CMS）。 Craft CMS 4.13.8版本至4.16.2版本和5.5.8版本至5.8.3版本存在代码注入漏洞，该漏洞源于安全密钥被破坏时可能允许远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A