Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-32432 Details

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:10 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CNA: [email protected]CVSS-B:10 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/	CISA-ADP	ExploitPress/Media Coverage
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432	CISA-ADP	US Government Resource
https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical	[email protected]	ProductRelease Notes
https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical	[email protected]	ProductRelease Notes
https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical	[email protected]	ProductRelease Notes
https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47	[email protected]	Patch
https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3	[email protected]	Vendor Advisory

see all 7 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name	Date Added	Due Date	Required Action
Craft CMS Code Injection Vulnerability	Mar 20, 2026	Apr 3, 2026	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-noinfo	Insufficient Information to Classify Weakness	[email protected]
CWE-94	Improper Control of Generation of Code ('Code Injection')	[email protected]

Affected Products

Product	Versions
craftcms craft cms	>= 3.0.0, < 3.9.15 >= 4.0.0, < 4.14.15 >= 5.0.0, < 5.6.17
CPE cpe:2.3:a:craftcms:craft_cms:::::::: Remediation No remediation found in references.

Change History

8 change records found show changes

Date	Action	Recorded By
Sep 24, 2026	CVE Translated	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Mar 20, 2026	Modified Analysis	[email protected]
Mar 20, 2026	CVE Modified	CISA-ADP
Apr 28, 2025	Initial Analysis	[email protected]
Apr 25, 2025	CVE Modified	CISA-ADP
Apr 25, 2025	New CVE Received	[email protected]