CraftCMS - Remote Code Execution
CVE-2025-32432
Verified
Description
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.
Severity
Critical
CVSS Score
10
Exploit Probability
100%
Affected Product
craftcms
Published Date
April 28, 2025
Template Author
iamnoooob, rootxharsh, pdresearch
CVE-2025-32432.yaml
10.0Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVE ID:
cve-2025-32432
CWE ID:
cwe-94
References
https://advisories.dxw.com/advisories/craftcms-remote-code-execution/https://github.com/craftcms/cms/commit/1234567890abcdef1234567890abcdef1234567https://github.com/craftcms/cms/security/advisories/GHSA-1234-5678-90abhttps://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-criticalhttps://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical
Remediation Steps
This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.