CVE-2025-32432
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
- Affected products
- Craft
- Craftcms Craft Cms
- < 3.9.15, 4.14.15, 5.6.17
- Fix
- Available
- CVSS 3.1
- 10.0 CRITICAL
- EPSS
- 99.8% (100th percentile)
- Weakness
- CWE-94
- NVD status
- Analyzed
- Published
- 2025-04-25
CVE-2025-32432 at NVD
17 known exploits for CVE-2025-32432
Proof-of-concept code and exploit modules indexed by Sploitus
Exploit for Code Injection in Craftcms Craft_Cms
Exploit for Code Injection in Craftcms Craft_Cms
Exploit for Code Injection in Craftcms Craft_Cms
Exploit for Code Injection in Craftcms Craft_Cms
Exploit for Code Injection in Craftcms Craft_Cms
Exploit for Code Injection in Craftcms Craft_Cms
📄 Craft CMS 5.6.16 Remote Code Execution
Exploit for Code Injection in Craftcms Craft_Cms
Craft CMS 5.6.16 - RCE
Exploit for Code Injection in Craftcms Craft_Cms
📄 Craft CMS 5.0 Logic Flaw
📄 Craft CMS 5.0 Authentication Session Path Exposure
Exploit for Code Injection in Craftcms Craft_Cms
Exploit for Code Injection in Craftcms Craft_Cms
📄 Craft CMS Image Transform Pre-Authenticaton Remote Code Execution
Exploit for Code Injection in Craftcms Craft_Cms
Craft CMS Image Transform Preauth RCE (CVE-2025-32432)