CVE-2025-54417: 
PHP vulnerability analysis and mitigation

CVE-2025-54417 is a remote code execution vulnerability in Craft CMS that represents a theoretical bypass for the previously patched CVE-2025-23209. It affects Craft CMS versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3, and was disclosed on August 8, 2025, by researcher Marco O. (segfault). The vulnerability carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 5.2 (Medium), reflecting the significant preconditions required for exploitation (GitHub Advisory).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). Exploitation requires two preconditions: a compromised Craft CMS security key and the ability to write an arbitrary file into the /storage/backups directory. With these in place, an attacker can craft a malicious HTTP request to the /updater/restore-db endpoint, which previously accepted a dbBackupPath parameter and passed it to the database restore function without sufficient validation — allowing CLI commands to be executed remotely. The fix (commit a19d46b) removes automated DB restoring from web updates entirely, deprecating the actionRestoreDb() method and throwing a NotSupportedException instead (GitHub Advisory, Patch Commit).

Successful exploitation allows a low-privileged attacker to execute arbitrary CLI commands on the server hosting Craft CMS, resulting in high impact to confidentiality, integrity, and availability of the affected system. An attacker could access or exfiltrate sensitive data, modify system files, install backdoors, or fully compromise the Craft CMS instance. The scope is limited to the vulnerable system itself, with no direct subsequent system impact noted in the CVSS assessment (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.047% (0.000470), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for a pre-compromised security key and the ability to write files to the backups directory, making opportunistic mass exploitation unlikely.

1. Obtain a compromised security key: Acquire the Craft CMS application's .env security key through prior compromise, credential theft, or exposure (e.g., leaked .env file, misconfigured server).
2. Write a malicious file to /storage/backups: Leverage any available file write primitive — such as a separate file upload vulnerability, SSRF, or server misconfiguration — to place a crafted file (e.g., a malicious SQL dump or script) in Craft's /storage/backups directory.
3. Craft a malicious request to /updater/restore-db: Using the compromised security key to authenticate or sign the request, send a specially crafted HTTP POST request to the /updater/restore-db endpoint, supplying the path to the malicious file as the dbBackupPath parameter.
4. Achieve remote code execution: The endpoint passes the attacker-controlled backup path to the database restore function, which executes CLI commands on the server, enabling arbitrary command execution under the web server's process context (GitHub Advisory, Patch Commit).

• Network: Unexpected HTTP POST requests to /updater/restore-db endpoint, particularly from unusual source IPs or at unusual times; outbound connections from the web server process to unknown external hosts following such requests.
• File System: Presence of unexpected or suspicious files in the Craft CMS /storage/backups directory (e.g., files with unusual extensions, non-standard naming, or recently created timestamps not corresponding to legitimate backup operations).
• Logs: Web server access logs showing POST requests to /updater/restore-db with non-standard parameters; Craft CMS application logs showing database restore attempts or errors from unexpected sources.
• Process: Unusual child processes spawned by the PHP or web server process (e.g., bash, sh, curl, wget, python) following requests to the updater endpoint.

Upgrade Craft CMS to version 4.16.3 or 5.8.4, which remove the vulnerable actionRestoreDb() functionality entirely by deprecating automated DB restoring from web updates (GitHub Advisory, Patch Commit). As interim mitigations, rotate and protect the Craft CMS security key immediately, restrict write access to the /storage/backups directory to only trusted processes, and implement network-level controls to limit access to the /updater/ endpoints. Regularly audit access logs for suspicious requests to updater endpoints.