CVE-2025-32432

Published Apr 25, 2025

Last updated 4 months ago

Exploit known CVSS critical 10.0

Craft CMS

Splunk

Zero-day

Open source

Server

Mobile device

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-32432 is a remote code execution (RCE) vulnerability affecting Craft CMS, a content management system. The vulnerability stems from an issue in the Yii PHP framework that Craft CMS utilizes. Specifically, it affects Craft CMS versions 3.0.0-RC1 before 3.9.15, 4.0.0-RC1 before 4.14.15, and 5.0.0-RC1 before 5.6.17. The vulnerability allows attackers to send specially crafted requests, potentially leading to the execution of malicious PHP code on the server. Security researchers have observed attackers chaining CVE-2025-32432 with another vulnerability (CVE-2024-58136) in zero-day attacks to breach servers, install PHP-based file managers, upload backdoors, and exfiltrate sensitive data. Patched versions (3.9.15, 4.14.15, and 5.6.17) have been released to address this issue.

Description: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
Source: security-advisories@github.com
NVD status: Analyzed
Products: craft_cms

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Craft CMS Code Injection Vulnerability
Exploit added on: Mar 20, 2026
Exploit action due: Apr 3, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security-advisories@github.com: CWE-94
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BCB171F0-5C1B-48AE-831E-711510AA3BB9",
            "versionEndExcluding": "3.9.15",
            "versionStartIncluding": "3.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "502743C7-CDF1-4644-8371-FFB97DE1A4E6",
            "versionEndExcluding": "4.14.15",
            "versionStartIncluding": "4.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EA89FA02-0C55-47CE-8B8B-4A383F6F2E65",
            "versionEndExcluding": "5.6.17",
            "versionStartIncluding": "5.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.