10

CVE-2025-32432: Craft CMS Code Injection Vulnerability

CVSS: 10.0v3.1CriticalKEVAnalyzed
Published 25-04-2025Last modified 21-03-2026
Open JSON

Vulnerability summary

CVE-2025-32432 is a critical (CVSS 10.0) Code Injection vulnerability in Craft CMS. It is known to be exploited: CISA lists it, first on 20-03-2026. EPSS estimates a 99.79% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
99.79%
0%100%
Critical · -0.04 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits3reference, exploit-database, metasploit

Timeline

  1. 25-04-2025
    PublishedVulnerability first disclosed.
  2. 20-03-2026
    Added to CISA KEVCraft CMS Code Injection Vulnerability
  3. 21-03-2026
    Last modifiedVulnerability information updated.
  4. 03-04-2026
    CISA remediation dueApply mitigations per vendor instructions.

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

99.79%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.04 pp

From 99.84% on 20-09-2026

20-09-202620-10-2026
EPSS score
99.79%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
20-03-2026
Federal due date
03-04-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. craftcms.com/knowledge-base/craft-cms-cve-2025-32432 github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 nvd.nist.gov/vuln/detail/CVE-2025-32432

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (sensepost.com)

    Maturity: unknown

  • exploit-databasemultipleUnverified

    Craft CMS 5.6.16 - RCE

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Craft CMS Image Transform Preauth RCE (CVE-2025-32432)

    exploit/linux/http/craftcms_preauth_rce_cve_2025_32432

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Craftcms2 products
  • cms≥ 3.0.0-RC1, < 3.9.15 | ≥ 4.0.0-RC1, < 4.14.15 | ≥ 5.0.0-RC1, < 5.6.17
  • craft_cms≥ 3.0.0, < 3.9.15 | ≥ 4.0.0, < 4.14.15 | ≥ 5.0.0, < 5.6.17

1 vendor · 2 products

References

7 links