CVE-2025-32432
Published 2025-04-25 · Updated 2026-09-24 · Source security-advisories@github.com
Summary
CVE-2025-32432 is a critical-severity (CVSS 10.0) vulnerability in Craft CMS Craft CMS. CISA added it to the Known Exploited Vulnerabilities catalog on March 20, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 3, 2026. CISA does not currently list it as used in ransomware campaigns. Craft CMS has 4 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 4 known-exploited Craft CMS vulnerabilities →Description
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CISA Known-Exploited Vulnerability
Product: Craft CMS — Craft CMS
Name: Craft CMS Code Injection Vulnerability
Date added: 2026-03-20 · Due: 2026-04-03
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical
- https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical
- https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical
- https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47
- https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
- https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432