CVE-2025-32432
Craft CMS Code Injection Vulnerability
Description
CVE-2025-32432 is a CRITICAL remote code execution vulnerability in Craft CMS, carrying the maximum CVSS 3.1 score of 10.0. Starting from version 3.0.0-RC1, Craft CMS is vulnerable to remote code execution through a code injection flaw. This is a high-impact, low-complexity attack vector that allows unauthenticated remote attackers to execute arbitrary code on the server. The vulnerability serves as an additional fix for CVE-2023-41892. Affected versions include Craft CMS >= 3.0.0 < 3.9.15, >= 4.0.0 < 4.14.15, and >= 5.0.0 < 5.6.17. Classified under CWE-94 (Code Injection), this CVE was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-03-20 with a remediation deadline of 2026-04-03. With an exceptionally high EPSS score of 87.671% (99.5th percentile), this vulnerability ranks among the most actively exploited vulnerabilities tracked. No ransomware association has been confirmed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| craftcms | craft cms | >= 3.0.0, < 3.9.15; >= 4.0.0, < 4.14.15; >= 5.0.0, < 5.6.17 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical(Product, Release Notes)
- https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical(Product, Release Notes)
- https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical(Product, Release Notes)
- https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47(Patch)
- https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3(Vendor Advisory)
- https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/(Exploit, Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432(US Government Resource)
Weakness Type
CWE-94: Improper Neutralization of Directives in Dynamically Evaluated Code (Code Injection)
CVE-2025-32432 is classified under CWE-94 — Code Injection. This weakness occurs when software constructs all or part of a code segment using externally-influenced input but does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code.
In the context of Craft CMS, this code injection vulnerability allows remote attackers to inject and execute arbitrary code on the server. Code injection is distinct from command injection (CWE-78) in that the attacker injects code that is interpreted by the application itself rather than by a system shell. This vulnerability class is particularly dangerous in content management systems because CMS platforms inherently process and render user-supplied content, creating numerous potential injection points.
This vulnerability is related to CVE-2023-41892, a previous code injection vulnerability in Craft CMS that was not fully remediated. The persistence of this vulnerability class across multiple versions highlights the difficulty of completely eliminating code injection vectors in complex web applications, especially those with template engines and dynamic content processing capabilities.
Impact Analysis
CVE-2025-32432 carries the maximum CVSS 3.1 score of 10.0 (CRITICAL) with Changed Scope.
Confidentiality (HIGH): Successful exploitation provides the attacker with complete access to all data stored and processed by the Craft CMS instance, including database contents, configuration files with database credentials and API keys, uploaded media, user data, and session tokens.
Integrity (HIGH): Attackers can modify any content managed by Craft CMS, alter templates, inject malicious code into served pages (watering hole attacks), modify user accounts, and install persistent backdoors. The CMS's administrative capabilities amplify the impact of integrity compromise.
Availability (LOW): While disruption is possible, the CVSS vector rates availability impact as LOW, indicating the primary threat is data theft and system modification rather than denial of service.
Scope (Changed): The Changed scope designation is critical — it indicates that exploitation of Craft CMS can impact resources beyond the vulnerable component itself. An attacker gaining code execution on the CMS server can pivot to attack other systems on the same network, access shared databases, or compromise the hosting infrastructure.
Attack Vector (Network) / Complexity (Low) / Privileges (None) / User Interaction (None): The vulnerability is fully remotely exploitable without authentication, credentials, or user interaction, with no special conditions required. This combination of factors drives the maximum CVSS score.
Exploit Maturity
CVE-2025-32432 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
KEV status: Added to the KEV catalog on 2026-03-20 with a mandatory remediation deadline of 2026-04-03 for federal agencies. Given the maximum CVSS score and exceptional EPSS rating, this should be treated as the highest priority for remediation.
EPSS score: The EPSS score of 87.671% (99.5th percentile) is exceptionally high, placing this vulnerability in the top 0.5% of all tracked vulnerabilities for exploitation likelihood. This score reflects widespread active exploitation, readily available exploit code, and the large attack surface of internet-facing Craft CMS installations.
Historical context: This vulnerability is an additional fix for CVE-2023-41892, indicating that the original remediation was incomplete. Threat actors who developed exploits for the earlier vulnerability likely adapted them quickly for this variant.
Ransomware association: As of the latest KEV data, no direct ransomware campaign association has been confirmed. However, the ease of exploitation and the prevalence of Craft CMS in production environments make it a high-value target for both ransomware operators and advanced persistent threat (APT) groups.
Attack surface: Craft CMS is widely deployed for enterprise websites and e-commerce platforms. Any internet-facing Craft CMS instance running an affected version is a viable target. The high EPSS score confirms that exploitation is occurring at scale.
Remediation
- Apply Craft CMS patches immediately. Upgrade to Craft CMS 3.9.15, 4.14.15, or 5.6.17 (depending on your major version). Consult the Craft CMS security advisory for specific patch guidance. This is a critical update that should be applied with the highest urgency.
- Identify all Craft CMS instances in your environment. Use asset discovery and vulnerability scanning tools to locate every Craft CMS installation across your infrastructure. Verify the exact version of each instance. Pay special attention to forgotten or unmaintained installations that may still be accessible from the internet.
- Implement immediate network-level protections if patching is delayed. Place a Web Application Firewall (WAF) in front of all Craft CMS instances with rules targeting code injection patterns. Consider temporarily restricting public access to the CMS admin panel and API endpoints. If the CMS does not need to be publicly accessible, place it behind a VPN or IP whitelist.
- Conduct thorough compromise assessment. Given the 87.671% EPSS score and confirmed active exploitation, assume that unpatched instances may already be compromised. Review web server logs for exploitation indicators, check for unauthorized file modifications, audit user accounts for unauthorized additions, and scan for web shells or backdoors.
- Implement post-patch hardening measures. After patching, rotate all credentials stored in or accessible from the Craft CMS configuration (database passwords, API keys, SMTP credentials). Review file system permissions to ensure the CMS runs with minimal privileges. Enable comprehensive logging and monitoring for future threat detection.
Technical Details
CVE-2025-32432 is a CRITICAL remote code execution vulnerability in Craft CMS affecting all versions from 3.0.0-RC1 onward until the patched releases.
Technical mechanism: The vulnerability is a code injection flaw that allows remote attackers to execute arbitrary code on the server hosting Craft CMS. It serves as an additional fix for CVE-2023-41892, indicating the original vulnerability was not fully resolved. The specific technical vector involves the way Craft CMS processes certain requests, allowing attacker-controlled input to reach code execution paths without proper sanitization.
CVSS 3.1 vector breakdown (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L):
- Attack Vector (Network): The vulnerability is exploitable remotely over HTTP/HTTPS without requiring local or adjacent network access.
- Attack Complexity (Low): The attack does not require specialized conditions, race conditions, or target-specific reconnaissance. Exploitation is straightforward and repeatable.
- Privileges Required (None): No authentication or authorization is needed. Any remote attacker who can reach the Craft CMS instance can exploit the vulnerability.
- User Interaction (None): Exploitation requires no action from any user — it is fully automated.
- Scope (Changed): This is a key differentiator that contributes to the 10.0 score. Exploitation of Craft CMS can compromise resources beyond the CMS itself, including the underlying server, adjacent network systems, and shared infrastructure.
- Confidentiality (HIGH): Full read access to all data accessible from the CMS server context.
- Integrity (HIGH): Full modification capability for all data and files accessible from the CMS server context.
- Availability (LOW): Limited disruption capability, as the primary impact is through data access and modification rather than denial of service.
Affected version ranges: The vulnerability spans three major version branches: 3.x (3.0.0-RC1 through 3.9.14), 4.x (4.0.0 through 4.14.14), and 5.x (5.0.0 through 5.6.16). This broad affected range means virtually every Craft CMS installation requires patching.
Frequently Asked Questions
What is CVE-2025-32432?
CVE-2025-32432 is a CRITICAL remote code execution vulnerability (CVSS 10.0 — the maximum score) in Craft CMS, a popular content management system. The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the server. It was added to CISA's KEV catalog on 2026-03-20 and has an EPSS score of 87.671%, indicating near-certain exploitation.
Which versions of Craft CMS are affected?
Three major version branches are affected: Craft CMS 3.x (from 3.0.0-RC1 to 3.9.14), 4.x (from 4.0.0 to 4.14.14), and 5.x (from 5.0.0 to 5.6.16). The fixed versions are 3.9.15, 4.14.15, and 5.6.17 respectively. Virtually every Craft CMS installation needs to be updated.
How is CVE-2025-32432 related to CVE-2023-41892?
CVE-2025-32432 is an additional fix for CVE-2023-41892, a previous code injection vulnerability in Craft CMS. This means the original remediation for CVE-2023-41892 was incomplete, and the underlying code injection vector was not fully eliminated. Organizations that patched for CVE-2023-41892 must update again to fully resolve the issue.
How severe is CVE-2025-32432 compared to other vulnerabilities?
CVE-2025-32432 has the maximum possible CVSS score of 10.0, which is reserved for the most critical vulnerabilities. Its EPSS score of 87.671% (99.5th percentile) means it is among the most actively exploited vulnerabilities globally. The combination of unauthenticated access, low complexity, network attack vector, and changed scope makes this one of the most dangerous web application vulnerabilities in recent memory. Immediate patching is essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.