CVE-2025-32432GHSA-f3gw-9ww9-jmc3

Craft CMS Code Injection Vulnerability

Craft CMS Craft CMSPackagistApplications & CMS

CVSS

10.0Critical

ExploitationExploited in the wildAdded to KEV 20 Mar 2026CISA KEV

Exploit odds (EPSS)99.8%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.9.15Also 4.14.15, 5.6.17OSV

Federal deadline3 Apr 2026Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

3.9.15craftcms/cms, PackagistOSVcomposer require "craftcms/cms:^3.9.15"
4.14.15craftcms/cms, PackagistOSVcomposer require "craftcms/cms:^4.14.15"
5.6.17craftcms/cms, PackagistOSVcomposer require "craftcms/cms:^5.6.17"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

14 Apr 2025Exploit code publicMetasploit
25 Apr 2025, 15:04 UTCPublishedCVE List
20 Mar 2026Added to CISA KEVCISA KEV

Public exploit code and templates 3

Exploit moduleCraft CMS Image Transform Preauth RCE (CVE-2025-32432) 14 Apr 2025Metasploit
Webapps exploitCraft CMS 5.6.16 - RCE 29 Apr 2026Exploit-DB
Scanner templateCraftCMS - Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.

Text from CVE List

Affected versions 156

cmsaffected: >= 3.0.0-RC1, < 3.9.15CVE List
cmsaffected: >= 4.0.0-RC1, < 4.14.15CVE List
cmsaffected: >= 5.0.0-RC1, < 5.6.17CVE List
craftcms/cms, Packagistfrom 3.0.0-RC1, fixed in 3.9.15OSV
craftcms/cms, Packagist3.0.0OSV
craftcms/cms, Packagist3.0.0-RC1OSV
craftcms/cms, Packagist3.0.0-RC10OSV
craftcms/cms, Packagist3.0.0-RC10.1OSV
craftcms/cms, Packagist3.0.0-RC11OSV
craftcms/cms, Packagist3.0.0-RC12OSV
craftcms/cms, Packagist3.0.0-RC13OSV
craftcms/cms, Packagist3.0.0-RC14OSV
craftcms/cms, Packagist3.0.0-RC15OSV
craftcms/cms, Packagist3.0.0-RC16OSV
craftcms/cms, Packagist3.0.0-RC16.1OSV
craftcms/cms, Packagist3.0.0-RC17OSV
craftcms/cms, Packagist3.0.0-RC17.1OSV
craftcms/cms, Packagist3.0.0-RC2OSV
craftcms/cms, Packagist3.0.0-RC3OSV
craftcms/cms, Packagist3.0.0-RC4OSV
craftcms/cms, Packagist3.0.0-RC5OSV
craftcms/cms, Packagist3.0.0-RC6OSV
craftcms/cms, Packagist3.0.0-RC7OSV
craftcms/cms, Packagist3.0.0-RC7.1OSV
craftcms/cms, Packagist3.0.0-RC8OSV
craftcms/cms, Packagist3.0.0-RC9OSV
craftcms/cms, Packagist3.0.0.1OSV
craftcms/cms, Packagist3.0.0.2OSV
craftcms/cms, Packagist3.0.1OSV
craftcms/cms, Packagist3.0.10OSV
craftcms/cms, Packagist3.0.10.1OSV
craftcms/cms, Packagist3.0.10.2OSV
craftcms/cms, Packagist3.0.10.3OSV
craftcms/cms, Packagist3.0.11OSV
craftcms/cms, Packagist3.0.12OSV
craftcms/cms, Packagist3.0.13OSV
craftcms/cms, Packagist3.0.13.1OSV
craftcms/cms, Packagist3.0.13.2OSV
craftcms/cms, Packagist3.0.14OSV
craftcms/cms, Packagist3.0.15OSV
craftcms/cms, Packagist3.0.16OSV
craftcms/cms, Packagist3.0.16.1OSV
craftcms/cms, Packagist3.0.17OSV
craftcms/cms, Packagist3.0.17.1OSV
craftcms/cms, Packagist3.0.18OSV
craftcms/cms, Packagist3.0.19OSV
craftcms/cms, Packagist3.0.2OSV
craftcms/cms, Packagist3.0.20OSV
craftcms/cms, Packagist3.0.21OSV
craftcms/cms, Packagist3.0.22OSV
craftcms/cms, Packagist3.0.23OSV
craftcms/cms, Packagist3.0.23.1OSV
craftcms/cms, Packagist3.0.24OSV
craftcms/cms, Packagist3.0.25OSV
craftcms/cms, Packagistfrom 4.0.0-RC1, fixed in 4.14.15OSV
craftcms/cms, Packagist4.0.0OSV
craftcms/cms, Packagist4.0.0-RC1OSV
craftcms/cms, Packagist4.0.0-RC2OSV
craftcms/cms, Packagist4.0.0-RC3OSV
craftcms/cms, Packagist4.0.0.1OSV
craftcms/cms, Packagist4.0.1OSV
craftcms/cms, Packagist4.0.2OSV
craftcms/cms, Packagist4.0.3OSV
craftcms/cms, Packagist4.0.4OSV
craftcms/cms, Packagist4.0.5OSV
craftcms/cms, Packagist4.0.5.1OSV
craftcms/cms, Packagist4.0.5.2OSV
craftcms/cms, Packagist4.0.6OSV
craftcms/cms, Packagist4.1.0OSV
craftcms/cms, Packagist4.1.0.1OSV
craftcms/cms, Packagist4.1.0.2OSV
craftcms/cms, Packagist4.1.1OSV
craftcms/cms, Packagist4.1.2OSV
craftcms/cms, Packagist4.1.3OSV
craftcms/cms, Packagist4.1.4OSV
craftcms/cms, Packagist4.1.4.1OSV
craftcms/cms, Packagist4.10.0OSV
craftcms/cms, Packagist4.10.0-beta.1OSV
craftcms/cms, Packagist4.10.0-beta.2OSV
craftcms/cms, Packagist4.10.1OSV
craftcms/cms, Packagist4.10.2OSV
craftcms/cms, Packagist4.10.3OSV
craftcms/cms, Packagist4.10.4OSV
craftcms/cms, Packagist4.10.5OSV
craftcms/cms, Packagist4.10.6OSV
craftcms/cms, Packagist4.10.7OSV
craftcms/cms, Packagist4.10.8OSV
craftcms/cms, Packagist4.11.0OSV
craftcms/cms, Packagist4.11.0.1OSV
craftcms/cms, Packagist4.11.0.2OSV
craftcms/cms, Packagist4.11.1OSV
craftcms/cms, Packagist4.11.2OSV
craftcms/cms, Packagist4.11.3OSV
craftcms/cms, Packagist4.11.4OSV
craftcms/cms, Packagist4.11.5OSV
craftcms/cms, Packagist4.12.0OSV
craftcms/cms, Packagist4.12.1OSV
craftcms/cms, Packagist4.12.2OSV
craftcms/cms, Packagist4.12.3OSV
craftcms/cms, Packagist4.12.4OSV
craftcms/cms, Packagist4.12.4.1OSV
craftcms/cms, Packagist4.12.5OSV
craftcms/cms, Packagist4.12.6OSV
craftcms/cms, Packagist4.12.6.1OSV
craftcms/cms, Packagist4.12.7OSV
craftcms/cms, Packagistfrom 5.0.0-RC1, fixed in 5.6.17OSV
craftcms/cms, Packagist5.0.0OSV
craftcms/cms, Packagist5.0.0-RC1OSV
craftcms/cms, Packagist5.0.1OSV
craftcms/cms, Packagist5.0.2OSV
craftcms/cms, Packagist5.0.3OSV
craftcms/cms, Packagist5.0.4OSV
craftcms/cms, Packagist5.0.5OSV
craftcms/cms, Packagist5.0.6OSV
craftcms/cms, Packagist5.1.0OSV
craftcms/cms, Packagist5.1.1OSV
craftcms/cms, Packagist5.1.10OSV
craftcms/cms, Packagist5.1.2OSV
craftcms/cms, Packagist5.1.3OSV
craftcms/cms, Packagist5.1.4OSV
craftcms/cms, Packagist5.1.5OSV
craftcms/cms, Packagist5.1.6OSV
craftcms/cms, Packagist5.1.7OSV
craftcms/cms, Packagist5.1.8OSV
craftcms/cms, Packagist5.1.9OSV
craftcms/cms, Packagist5.2.0OSV
craftcms/cms, Packagist5.2.0-beta.1OSV
craftcms/cms, Packagist5.2.0-beta.2OSV
craftcms/cms, Packagist5.2.0-beta.3OSV
craftcms/cms, Packagist5.2.0-beta.4OSV
craftcms/cms, Packagist5.2.0-beta.5OSV
craftcms/cms, Packagist5.2.0-beta.6OSV
craftcms/cms, Packagist5.2.1OSV
craftcms/cms, Packagist5.2.10OSV
craftcms/cms, Packagist5.2.2OSV
craftcms/cms, Packagist5.2.3OSV
craftcms/cms, Packagist5.2.4OSV
craftcms/cms, Packagist5.2.4.1OSV
craftcms/cms, Packagist5.2.5OSV
craftcms/cms, Packagist5.2.6OSV
craftcms/cms, Packagist5.2.7OSV
craftcms/cms, Packagist5.2.8OSV
craftcms/cms, Packagist5.2.9OSV
craftcms/cms, Packagist5.3.0OSV
craftcms/cms, Packagist5.3.0-beta.1OSV
craftcms/cms, Packagist5.3.0-beta.2OSV
craftcms/cms, Packagist5.3.0.1OSV
craftcms/cms, Packagist5.3.0.2OSV
craftcms/cms, Packagist5.3.0.3OSV
craftcms/cms, Packagist5.3.1OSV
craftcms/cms, Packagist5.3.2OSV
craftcms/cms, Packagist5.3.3OSV
craftcms/cms, Packagist5.3.4OSV
craftcms/cms, Packagist5.3.5OSV
craftcms/cms, Packagist5.3.6OSV
craftcms/cms, Packagist5.4.0OSV