CVE-2025-32432 kev in the critical feed json
Craft CMS Allows Remote Code Execution
published 2025-04-25 18 mo ago modified 2026-09-24 45 d ago also EUVD-2025-12521 , GHSA-f3gw-9ww9-jmc3
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Exploited
- added 2026-03-20
- epss
- 99.8%
- EPSS 99.8% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
Patch / fix
cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- packagist craftcms/cms 3.9.15, 4.14.15, 5.6.17
- craftcms craft_cms 3.9.15, 4.14.15, 5.6.17
Timeline
- First public exploit (Metasploit exploit/linux/http/craftcms_preauth_rce_cve_2025_32432)
- Published
- CISA SSVC: exploitation active
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 7 mo ago
- Patch by
- 2026-04-03 (7 mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Craft CMS, Craft CMS
- CISA name
- Craft CMS Code Injection Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
99.79% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/craftcms_preauth_rce_cve_2025_32432 Craft CMS Image Transform Preauth RCE (CVE-2025-32432) metasploit exploit, excellent rank, 2025-04-14
- EDB-52525 Craft CMS 5.6.16 - RCE webapps, 2026-04-29
- Nuclei template CraftCMS - Remote Code Execution nuclei detection template
- sensepost.com https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L |
| NVD | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/cms | >=3.0.0-RC1, <3.9.15 >=4.0.0-RC1, <4.14.15 >=5.0.0-RC1, <5.6.17 |
3.9.15 4.14.15 5.6.17 |
Affected products
- craftcms cms
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47
web, patch
-
sensepost.com
/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
technical-description, exploit, press/media-coverage
-
github.com
/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
web, vendor-advisory
-
github.com
/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical
web, product, release-notes
-
github.com
/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical
web, product, release-notes
-
github.com
/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical
web, product, release-notes
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432
government-resource, web, us-government-resource
-
github.com
/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-32432
advisory
-
craftcms.com
/knowledge-base/craft-cms-cve-2025-32432
web
-
github.com
/craftcms/cms
package
-
sensepost.com
/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms
web
Sources
- CVE List CVE-2025-32432
- GitHub Advisory GHSA-f3gw-9ww9-jmc3
- NVD CVE-2025-32432
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.