Every CVE Search/ Get API key

CVE-2025-32432

Craft CMS Allows Remote Code Execution

10.0 CriticalIn KEVPublic exploitFix available

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

99.8%Up 99.7 points since Apr 26, 2025
90%50%10%1%

What each source reports

CVE List Score used 10.0

Craft CMS Allows Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

Record
CVE-2025-32432
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2025-12521 10.0

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

Record
EUVD-2025-12521
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-f3gw-9ww9-jmc3 10.0

Craft CMS Allows Remote Code Execution

Impact

This is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g

This is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version.

Details

https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432

References

https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47

https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical

https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/

Credits

Credit to Orange Cyberdefense for discovering a reporting this bug.

Record
GHSA-f3gw-9ww9-jmc3
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-94
Updated
2026-11-02
CISA KEV No score

Craft CMS Code Injection Vulnerability

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.

Record
CVE-2025-32432
Weakness
CWE-94
Updated
2026-11-02
NVD 10.0

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

Record
CVE-2025-32432
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 10.0

Craft CMS Allows Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

Record
CVE-2025-32432
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-f3gw-9ww9-jmc3 10.0

Craft CMS Allows Remote Code Execution

Impact

This is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g

This is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version.

Details

https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432

References

https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47

https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical

https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/

Credits

Credit to Orange Cyberdefense for discovering a reporting this bug.

Record
GHSA-f3gw-9ww9-jmc3
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-94
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
craftcms/cms
Packagist
 3.0.0-RC1 to 3.9.14
3.9.15
craftcms/cms
Packagist
 4.0.0-RC1 to 4.14.14
4.14.15
craftcms/cms
Packagist
 5.0.0-RC1 to 5.6.16
5.6.17
craftcms/cms
Packagist
 3.0.0-RC1 up to 3.9.15, plus listed versions
3.0.03.0.0-RC103.0.0-RC10.13.0.0-RC113.0.0-RC12
Show 45 moreShow less
3.0.0-RC133.0.0-RC143.0.0-RC153.0.0-RC163.0.0-RC16.13.0.0-RC173.0.0-RC17.13.0.0-RC23.0.0-RC33.0.0-RC43.0.0-RC53.0.0-RC63.0.0-RC73.0.0-RC7.13.0.0-RC83.0.0-RC93.0.0.13.0.0.23.0.13.0.103.0.10.13.0.10.23.0.10.33.0.113.0.123.0.133.0.13.13.0.13.23.0.143.0.153.0.163.0.16.13.0.173.0.17.13.0.183.0.193.0.23.0.203.0.213.0.223.0.233.0.23.13.0.243.0.253.0.26
3.9.15
craftcms/cms
Packagist
 4.0.0-RC1 up to 4.14.15, plus listed versions
4.0.04.0.0-RC24.0.0-RC34.0.0.14.0.1
Show 45 moreShow less
4.0.24.0.34.0.44.0.54.0.5.14.0.5.24.0.64.1.04.1.0.14.1.0.24.1.14.1.24.1.34.1.44.1.4.14.10.04.10.0-beta.14.10.0-beta.24.10.14.10.24.10.34.10.44.10.54.10.64.10.74.10.84.11.04.11.0.14.11.0.24.11.14.11.24.11.34.11.44.11.54.12.04.12.14.12.24.12.34.12.44.12.4.14.12.54.12.64.12.6.14.12.74.12.8
4.14.15
craftcms/cms
Packagist
 5.0.0-RC1 up to 5.6.17, plus listed versions
5.0.05.0.15.0.25.0.35.0.4
Show 45 moreShow less
5.0.55.0.65.1.05.1.15.1.105.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-beta.15.2.0-beta.25.2.0-beta.35.2.0-beta.45.2.0-beta.55.2.0-beta.65.2.15.2.105.2.25.2.35.2.45.2.4.15.2.55.2.65.2.75.2.85.2.95.3.05.3.0-beta.15.3.0-beta.25.3.0.15.3.0.25.3.0.35.3.15.3.25.3.35.3.45.3.55.3.65.4.05.4.0.1
5.6.17

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitCraft CMS Image Transform Preauth RCE (CVE-2025-32432)2025-04-14
PoC in GitHubChocapikk/CVE-2025-324322025-04-26
PoC in GitHubSachinart/CVE-2025-324322025-04-27
PoC in GitHubCTY-Research-1/CVE-2025-32432-PoC2025-06-01
PoC in GitHubbambooqj/CVE-2025-324322025-09-23
Exploit-DBCraft CMS 5.6.16 - RCE2026-04-29
PoC in GitHubTheMursalin/CVE-2025-324322026-04-30
PoC in GitHubcd-ratel/CVE-2025-324322026-05-15
PoC in GitHubn40y/PoC_CVE-2025-324322026-06-24
PoC in GitHubc0gnit00/CVE-2025-324322026-07-21
Show 8 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubtheeomega/CVE-2025-32432-POC2026-07-23
PoC in GitHubHeltonPojo/CVE-2025-324322026-07-30
PoC in GitHubPsyGuy007-sys/craftcms-cve-2025-32432-rce2026-08-05
PoC in GitHubEzraMansor/CVE-2025-32432-PoC2026-08-07
PoC in GitHubSi13NTTT/CVE-2025-324322026-09-14
PoC in GitHubP34NUT2/CVE-2025-32432-exploit-by-P34NUT2026-09-16
PoC in GitHubl0lsuit/CVE-2025-32432-craftcms-rce2026-10-12
NucleiCraftCMS - Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-32432 is a critical vulnerability (CVSS 10.0) in Craft Cms Cms, published April 25, 2025. CISA lists it as known to be exploited, since March 20, 2026. EUVD reports exploitation since March 20, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.8%, the 99th percentile. Fixed in craftcms/cms 3.9.15.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 597 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open