CVE-2025-32432

Published Apr 25, 2025

Last updated 9 months ago

Craft CMS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-32432 is a remote code execution (RCE) vulnerability affecting Craft CMS, a content management system. The vulnerability stems from an issue in the Yii PHP framework that Craft CMS utilizes. Specifically, it affects Craft CMS versions 3.0.0-RC1 before 3.9.15, 4.0.0-RC1 before 4.14.15, and 5.0.0-RC1 before 5.6.17. The vulnerability allows attackers to send specially crafted requests, potentially leading to the execution of malicious PHP code on the server. Security researchers have observed attackers chaining CVE-2025-32432 with another vulnerability (CVE-2024-58136) in zero-day attacks to breach servers, install PHP-based file managers, upload backdoors, and exfiltrate sensitive data. Patched versions (3.9.15, 4.14.15, and 5.6.17) have been released to address this issue.

Description: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
Source: security-advisories@github.com
NVD status: Analyzed
Products: craft_cms

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-94
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BCB171F0-5C1B-48AE-831E-711510AA3BB9",
            "versionEndExcluding": "3.9.15",
            "versionStartIncluding": "3.0.0"
          },
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "502743C7-CDF1-4644-8371-FFB97DE1A4E6",
            "versionEndExcluding": "4.14.15",
            "versionStartIncluding": "4.0.0"
          },
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EA89FA02-0C55-47CE-8B8B-4A383F6F2E65",
            "versionEndExcluding": "5.6.17",
            "versionStartIncluding": "5.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.