CVE-2025-32432 Craft CMS Code Injection
Craft CMS allows remote code execution via a high-impact, low-complexity attack vector, requiring immediate patching.
- Exploited in the wild
- Since 20 Mar 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32432?
CVE-2025-32432 is a critical code injection vulnerability in Craftcms Craft Cms, published on 25 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
Weakness: CWE-94
Which versions are affected by CVE-2025-32432?
6 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 3.0.0-RC1 | 3.9.15 |
craftcms/cms Packagist | From 3.0.0-RC1 | 3.9.15 |
craftcms/cms Packagist | From 4.0.0-RC1 | 4.14.15 |
craftcms/cms Packagist | From 4.0.0-RC1 | 4.14.15 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.6.17 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.6.17 |
Products include Craftcms Craft Cms.
How do I fix CVE-2025-32432?
Upgrade craftcms/cms to a fixed version for your release line: 3.9.15, 4.14.15 or 5.6.17. US federal agencies must fix it by 3 Apr 2026.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-32432 being exploited?
Yes. Attackers have exploited CVE-2025-32432 in the wild since at least 20 Mar 2026.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 15 proofs of concept on GitHub.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-f3gw-9ww9-jmc3.