CVE-2025-32432: Craftcms/cms Remote Code Execution Vulnerability

Q: What is CVE-2025-32432?

CVE-2025-32432 is a security vulnerability in Craftcms/cms involving Craft CMS Allows Remote Code Execution under CWE-94: Improper Control of Generation of Code ('Code Injection').

Q: Which Craftcms/cms versions are affected?

Affected versions include releases prior to 3.9.15, 4.14.15, 5.6.17 across affected packages: craftcms/cms.

Q: What version fixes CVE-2025-32432?

Upgrading to 3.9.15, 4.14.15, 5.6.17 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is craftcms/cms affected?

Yes, craftcms/cms is affected in releases prior to 3.9.15, 4.14.15, 5.6.17. Upgrade your dependency to 3.9.15, 4.14.15, 5.6.17 or later.

Q: What is the CVSS score of CVE-2025-32432?

CVE-2025-32432 has a CVSS v3.1 base score of 10.0 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.

Q: What CWE is associated with CVE-2025-32432?

CVE-2025-32432 is classified under CWE-94: Improper Control of Generation of Code ('Code Injection') (The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.).

Q: How can I check Packagist dependencies for CVE-2025-32432?

Run the dependency tree command: 'inspect dependencies for craftcms/cms'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

CRITICAL

Advisory Identifier: GHSA-f3gw-9ww9-jmc3

CVSS 10.0

CWE-94

Published 2025-04-25

Advisory Summary

CVE-2025-32432 is a CRITICAL (CVSS 10.0) remote code execution vulnerability (CWE-94: Improper Control of Generation of Code ('Code Injection')) affecting Craftcms/cms libraries in the Packagist ecosystem. The issue involves craft cms allows remote code execution. Remediation is available by upgrading affected packages to version 3.9.15, 4.14.15, 5.6.17.

CVE-2025-32432 at a Glance

CVE Identifier CVE-2025-32432

GHSA Identifier GHSA-f3gw-9ww9-jmc3

Severity CRITICAL

CVSS v3.1 Base Score 10.0

CWE Classification CWE-94: Improper Control of Generation of Code ('Code Injection')

Affected Product Craftcms/cms

Package Ecosystem Packagist

Published Date 2025-04-25

Last Updated 2026-03-20

Security Impact

CVSS: 10.0

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Changed (S:C)

Confidentiality High (C:H)

Integrity High (I:H)

Availability Low (A:L)

How to Fix CVE-2025-32432

To remediate this vulnerability, upgrade all affected Craftcms/cms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

craftcms/cms fixed: 3.9.15

Upgrade craftcms/cms to 3.9.15

craftcms/cms fixed: 4.14.15

Upgrade craftcms/cms to 4.14.15

craftcms/cms fixed: 5.6.17

Upgrade craftcms/cms to 5.6.17

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for craftcms/cms

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-32432, inspect your project dependencies for Craftcms/cms:

inspect dependencies for craftcms/cms

Analyze the terminal output to locate any version of Craftcms/cms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.9.15), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. In Craftcms/cms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact This is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g This is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version. ### Details https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432 ### References https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47 https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ ### Credits Credit to [Orange Cyberdefense](https://github.com/Orange-Cyberdefense) for discovering a reporting this bug.

CVE-2025-32432 Affected Craftcms/cms Versions

3 component(s)

Fixed Versions:

3.9.154.14.155.6.17

Product / Package	Ecosystem	Affected Versions	Fixed Version
craftcms/cms	Packagist	≥ 3.0.0-RC1 < 3.9.15	3.9.15
craftcms/cms	Packagist	≥ 4.0.0-RC1 < 4.14.15	4.14.15
craftcms/cms	Packagist	≥ 5.0.0-RC1 < 5.6.17	5.6.17

References

GitHub Advisory / Wiki ADVISORY

https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g

GitHub Advisory / Wiki ADVISORY

https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3

NVD — CVE-2025-32432 NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-32432

Security Fix Commit FIX COMMIT

https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47

craftcms.com/knowledge-base/craf... WEB

https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432

Craftcms/cms Source Repository REPOSITORY

https://github.com/craftcms/cms

Craftcms/cms Source Repository REPOSITORY

https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical

Craftcms/cms Source Repository REPOSITORY

https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical

Craftcms/cms Source Repository REPOSITORY

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical

sensepost.com/blog/2025/investiga... WEB

https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms

www.cisa.gov/known-exploited-vul... WEB

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432

Frequently Asked Questions

What is CVE-2025-32432?

CVE-2025-32432 is a security vulnerability in Craftcms/cms involving Craft CMS Allows Remote Code Execution under CWE-94: Improper Control of Generation of Code ('Code Injection').

Which Craftcms/cms versions are affected?

Affected versions include releases prior to 3.9.15, 4.14.15, 5.6.17 across affected packages: craftcms/cms.

What version fixes CVE-2025-32432?

Upgrading to 3.9.15, 4.14.15, 5.6.17 (or the latest patched release for your respective branch) resolves the vulnerability.

Is craftcms/cms affected?

Yes, craftcms/cms is affected in releases prior to 3.9.15, 4.14.15, 5.6.17. Upgrade your dependency to 3.9.15, 4.14.15, 5.6.17 or later.

What is the CVSS score of CVE-2025-32432?

CVE-2025-32432 has a CVSS v3.1 base score of 10.0 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.

What CWE is associated with CVE-2025-32432?

CVE-2025-32432 is classified under CWE-94: Improper Control of Generation of Code ('Code Injection') (The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.).

How can I check Packagist dependencies for CVE-2025-32432?

Run the dependency tree command: 'inspect dependencies for craftcms/cms'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f3gw-9ww9-jmc3",
  "modified" : "2026-03-20T21:28:37Z",
  "published" : "2025-04-25T15:02:53Z",
  "aliases" : [ "CVE-2025-32432" ],
  "summary" : "Craft CMS Allows Remote Code Execution",
  "details" : "### Impact\n\nThis is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g\n\nThis is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version. \n\n### Details\n\nhttps://craftcms.com/knowledge-base/craft-cms-cve-2025-32432\n\n### References\n\nhttps://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47\n\nhttps://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical\nhttps://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical\nhttps://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical\n\nhttps://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/\n\n### Credits\n\nCredit to [Orange Cyberdefense](https://github.com/Orange-Cyberdefense) for discovering a reporting this bug.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0-RC1"
      }, {
        "fixed" : "3.9.15"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.9.14"
    }
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0-RC1"
      }, {
        "fixed" : "4.14.15"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.14.14"
    }
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0-RC1"
      }, {
        "fixed" : "5.6.17"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.6.16"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-32432"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47"
  }, {
    "type" : "WEB",
    "url" : "https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/craftcms/cms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical"
  }, {
    "type" : "WEB",
    "url" : "https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms"
  }, {
    "type" : "WEB",
    "url" : "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-04-25T15:02:53Z",
    "nvd_published_at" : "2025-04-25T15:15:36Z"
  }
}

CVSS V3

10.0 CRITICAL

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Changed (S:C)

Confidentiality High (C:H)

Integrity High (I:H)

Availability Low (A:L)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Advisory Metadata

Source ID: GHSA-f3gw-9ww9-jmc3
Schema Version: 1.4.0
Published: 2025-04-25 15:02
Last Modified: 2026-03-20 21:28
Database Record File: advisories/github-reviewed/2025/04/GHSA-f3gw-9ww9-jmc3/GHSA-f3gw-9ww9-jmc3.json