Craft Cms
CVE-2025-32432
CRITICAL
GHSA-f3gw-9ww9-jmc3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Maximum risk (CVSS 10.0). Unauthenticated RCE with no user interaction required. Craft CMS powers thousands of websites, and the vulnerability spans three major versions. EPSS of 79% confirms high exploitation probability. |
| Exploit ScenarioDerived | An attacker scans for Craft CMS installations using fingerprinting techniques, then sends a crafted HTTP request that injects PHP code into the server-side execution context, gaining a web shell for persistent access, data exfiltration, or lateral movement. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
Craft CMS versions 3.x through 5.x contain a critical remote code execution vulnerability (CVSS 10.0) that allows unauthenticated attackers to execute arbitrary code on the server, actively exploited in the wild before patches were released.
Earlier versions of this analysis (1)
Craft CMS versions 3.0.0-RC1 through 3.9.14, 4.0.0-RC1 through 4.14.14, and 5.0.0-RC1 through 5.6.16 are vulnerable to unauthenticated remote code execution, rated CVSS 10.0, with active exploitation observed before patching.
RemediationAI
Immediately update to Craft CMS 3.9.15, 4.14.15, or 5.6.17. Review server logs for signs of exploitation, check for web shells, and audit any content modifications made before patching.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-94 code injection vulnerability allows unauthenticated attackers to inject and execute arbitrary PHP code through the CMS's request handling. The low-complexity attack vector requires no user interaction or authentication.
Know when Craft Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
Executive ViewAI
Craft CMS versions 3.0 through 5.6.16 contain a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands on affected servers without requiring user credentials or authentication. Organizations running Craft CMS are at immediate risk of complete system compromise, data theft, and malware deployment, as this vulnerability is confirmed actively exploited in the wild with public exploit code available and a 79% probability of exploitation.
Apply vendor patch. If patching cannot be completed immediately: implement network-layer access controls restricting inbound HTTP/HTTPS traffic to Craft CMS instances to trusted IP ranges only; deploy Web Application Firewall (WAF) rules blocking HTTP requests containing known RCE payload signatures; disable public-facing Craft CMS functionality until patches are applied; monitor application logs and web server logs for suspicious requests and command execution patterns.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
Craft CMS stores arbitrary content provided by unauthenticated users in session files. Rated medium severity (CVSS 6.9),
Craft CMS is a platform for creating digital experiences. Rated critical severity (CVSS 9.8), this vulnerability is remo
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Rated critical sev
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. Rated crit
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed
RCE in Craft CMS before 4.17.0-beta.1/5.9.0-beta.1 via template injection for authenticated admins. PoC and patch availa
Authenticated remote code execution in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 lets an
SQL injection in Craft CMS 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 allows authenticated Control Panel use
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Sectio
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the a
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and
Craft is a content management system (CMS). [CVSS 7.5 HIGH]