CVE-2025-32432

Craft CMS Code Injection Vulnerability

Severity: critical
CVSS v3: 10
EPSS percentile: 100%
Known exploited: yes (CISA KEV)
Vendor: Craft CMS
Product: Craft CMS
Published: 2026-03-20
Modified: 2026-09-24

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

NVD record

Informational only. Not a warranty of security, completeness or fitness for any purpose. Derived from NVD, CISA KEV, FIRST.org EPSS and vendor advisories (CVE Program List v5); those sources change continuously and may be incomplete or incorrect. Verify every remediation against the vendor advisory before acting. Absence of a finding is not evidence that no vulnerability exists. Not endorsed by NVD, CISA, FIRST or any vendor named.

Raw record

{
  "id": "CVE-2025-32432",
  "title": "Craft CMS Code Injection Vulnerability",
  "description": "Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.",
  "severity": "critical",
  "cvss": 10,
  "epss": 100,
  "kev": 1,
  "vendor": "Craft CMS",
  "product": "Craft CMS",
  "published": "2026-03-20",
  "modified": "2026-09-24T13:10:00.320",
  "source": "nvd",
  "remediation": [],
  "disclaimer": "Informational only. Not a warranty of security, completeness or fitness for any purpose. Derived from NVD, CISA KEV, FIRST.org EPSS and vendor advisories (CVE Program List v5); those sources change continuously and may be incomplete or incorrect. Verify every remediation against the vendor advisory before acting. Absence of a finding is not evidence that no vulnerability exists. Not endorsed by NVD, CISA, FIRST or any vendor named."
}