Type Vulnerability
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code. Known-exploited catalogue reports exploitation in the wild.
Craft
Craft CMS Code Injection Vulnerability
CVE-2025-32432
What this means
This is rated critical severity (10 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Craftcms Craft Cms is in your estate, and treat that as the priority.
Full vendor description
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
Scoring and exploitation
10.0/ 10
CVSS 3.1 base scoreCritical
Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality and integrity; low on availability, and it can reach beyond the vulnerable system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeChangedS:C
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityLowA:L
- Elevated attack likelihood (~99.8% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Craft CMS
Weaknesses
CWE-94NVD-CWE-noinfo
Affected products ()
- Craftcms Craft Cms
Show the raw CPE strings (1)
- cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
References
7 links from the CVE record, grouped by site; the vendor's advisory comes first.
github.com5 linksVendor advisory
- CHANGELOG.md (opens in a new tab)Product · Release Notes
- CHANGELOG.md (opens in a new tab)Product · Release Notes
- CHANGELOG.md (opens in a new tab)Product · Release Notes
Show 2 more from github.com
sensepost.com1 link
- investigating-an-in-the-wild-campaign-using-rce-in-craftcms (opens in a new tab)Exploit · Press/Media Coverage
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource