CVE-2025-32432criticalunder attackCWE-94

CVE-2025-32432: critical vulnerability in craftcms cms

Craft CMS Allows Remote Code Execution

Published · Updated

Follow this CVE+ Monitor cms+ Monitor Craft CMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 100%
from disclosure to weapon1 day
Published on NVDApr 25
1st PoC+1d
metasploitApr 14
CISA KEV+329d
Action required by CISAfederal deadline: 2026-04-03

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Craft CMS contains a critical flaw that allows attackers to execute arbitrary code remotely on affected servers. This vulnerability affects multiple versions and requires immediate patching to prevent complete system compromise.

Technical detail

Craft CMS versions 3.0.0-RC1 through 3.9.14, 4.0.0-RC1 through 4.14.14, and 5.0.0-RC1 through 5.6.16 are vulnerable to unauthenticated remote code execution via CWE-94 (improper control of generation of code). The attack has low complexity and no special privileges required, enabling direct takeover of the application and underlying server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Affected products
craftcms · cms
public PoCs found — 37
exploitdbwww.exploit-db.com/exploits/52525unverifiedgithubgithub.com/Sachinart/CVE-2025-32432★ 27githubgithub.com/Chocapikk/CVE-2025-32432★ 10githubgithub.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT★ 8githubgithub.com/CTY-Research-1/CVE-2025-32432-PoC★ 8githubgithub.com/c0gnit00/CVE-2025-32432★ 6githubgithub.com/cd-ratel/CVE-2025-32432★ 2githubgithub.com/bambooqj/CVE-2025-32432★ 2githubgithub.com/PsyGuy007-sys/craftcms-cve-2025-32432-rce★ 1githubgithub.com/Cosm3No1de/htb-orion-writeup★ 0githubgithub.com/HeltonPojo/CVE-2025-32432★ 0githubgithub.com/EzraMansor/CVE-2025-32432-PoC★ 0githubgithub.com/theeomega/CVE-2025-32432-POC★ 0githubgithub.com/l0lsuit/CVE-2025-32432-craftcms-rce★ 0githubgithub.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-32432★ 0githubgithub.com/TheMursalin/CVE-2025-32432★ 0githubgithub.com/Si13NTTT/CVE-2025-32432★ 0githubgithub.com/n40y/PoC_CVE-2025-32432★ 0vulncheckvulncheck.com/xdb/c6ea5169f9ecunverifiedvulncheckvulncheck.com/xdb/20a318144b85unverifiedvulncheckvulncheck.com/xdb/298d32565f13unverifiedvulncheckvulncheck.com/xdb/71e0e5da22daunverifiedvulncheckvulncheck.com/xdb/c4ef7063f832unverifiedcve_referencesensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/unverifiedvulncheckvulncheck.com/xdb/d95926da364bunverifiedvulncheckvulncheck.com/xdb/44a1c7835732unverifiedvulncheckvulncheck.com/xdb/475a01011f66unverifiedvulncheckvulncheck.com/xdb/8a66cba328d4unverifiedvulncheckvulncheck.com/xdb/594630302d82unverifiedvulncheckvulncheck.com/xdb/607359dbad90unverifiedvulncheckvulncheck.com/xdb/fd579a16deaeunverifiedvulncheckvulncheck.com/xdb/70ecf19db567unverifiedvulncheckvulncheck.com/xdb/e32d0c6e52f9unverifiedvulncheckvulncheck.com/xdb/3273899fa3b6unverifiedvulncheckvulncheck.com/xdb/d7daf9fe47f5unverifiedvulncheckvulncheck.com/xdb/912fcaaa7164unverifiedvulncheckvulncheck.com/xdb/8caef7d85a0bunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — craftcms cms

In the same product, most dangerous first.

CVE-2024-56145CRITICALRCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmsEPSS 97.5%KEVCVE-2025-23209HIGHPotential RCE with a compromised security key in craft/cmsEPSS 21.6%KEVCVE-2023-41892CRITICALCraft CMS Remote Code Execution vulnerabilityEPSS 94.2%CVE-2026-32267HIGHCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()EPSS 9.6%CVE-2023-40035HIGHCraft CMS vulnerable to Remote Code Execution via validatePath bypassEPSS 2.3%CVE-2023-32679HIGHRemote Code Execution via unrestricted file extension in Craft CMSEPSS 1.8%