Actively exploited · Published Apr 25, 2025 · Assigned by GitHub_M

CVE-2025-32432Craft CMS Allows Remote Code Execution

Critical 10.0 Exploited

In plain English

A critical-severity code injection in cms from craftcms. Attackers are actively exploiting it in the wild (listed by CISA on March 20, 2026). The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)99.8%top 0.0% of all CVEs

Exploited in the wildYesCISA KEV since Mar 20, 2026

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Apr 3, 2026.

Official description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	craftcms/cms	3.9.15	GHSA-f3gw-9ww9-jmc3
Packagist	craftcms/cms	4.14.15	GHSA-f3gw-9ww9-jmc3
Packagist	craftcms/cms	5.6.17	GHSA-f3gw-9ww9-jmc3

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	>= 3.0.0-RC1, < 3.9.15>= 4.0.0-RC1, < 4.14.15>= 5.0.0-RC1, < 5.6.17

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

References

https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 x_refsource_CONFIRM
https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47 x_refsource_MISC
https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical x_refsource_MISC
https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical x_refsource_MISC
https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical x_refsource_MISC
https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ technical-description, exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432 government-resource