CRITICAL Actively exploited CWE-94
CVE-2025-32432
Craft CMS Allows Remote Code Execution
10.0/ 10
CVSS 3.1
Critical severity
100%
EPSS exploit odds
Chance of exploitation in the next 30 days
Among the very highest of all CVEs
Listed
CISA KEV catalog
- Added
- Mar 20, 2026
- Fix due
- Apr 3, 2026
- Ransomware
- Not known
Timeline
- Published
- Apr 25, 2025
- Updated
- Mar 21, 2026
- First covered
- Jul 11, 2026
- Latest story
- 4 months ago
Summary
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
CWE-94Improper Control of Generation of Code ('Code Injection')
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Craftcms cms>= 3.0.0-RC1, < 3.9.15>= 4.0.0-RC1, < 4.14.15>= 5.0.0-RC1, < 5.6.17