CVE-2025-32432

Published Apr 25, 2025

Last updated a year ago

CVSS critical 10.0

Craft CMS

Overview

Description: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
Source: security-advisories@github.com
NVD status: Analyzed
Products: craft_cms

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-94
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BCB171F0-5C1B-48AE-831E-711510AA3BB9",
            "versionEndExcluding": "3.9.15",
            "versionStartIncluding": "3.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "502743C7-CDF1-4644-8371-FFB97DE1A4E6",
            "versionEndExcluding": "4.14.15",
            "versionStartIncluding": "4.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EA89FA02-0C55-47CE-8B8B-4A383F6F2E65",
            "versionEndExcluding": "5.6.17",
            "versionStartIncluding": "5.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References