CVE-2025-32432

Published Apr 25, 2025

Last updated 6 hours ago

Craft CMS

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-32432 is a remote code execution (RCE) vulnerability affecting Craft CMS, a content management system. The vulnerability stems from an issue in the Yii PHP framework that Craft CMS utilizes. Specifically, it affects Craft CMS versions 3.0.0-RC1 before 3.9.15, 4.0.0-RC1 before 4.14.15, and 5.0.0-RC1 before 5.6.17. The vulnerability allows attackers to send specially crafted requests, potentially leading to the execution of malicious PHP code on the server. Security researchers have observed attackers chaining CVE-2025-32432 with another vulnerability (CVE-2024-58136) in zero-day attacks to breach servers, install PHP-based file managers, upload backdoors, and exfiltrate sensitive data. Patched versions (3.9.15, 4.14.15, and 5.6.17) have been released to address this issue.

Description: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
Source: security-advisories@github.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-94
nvd@nist.gov: NVD-CWE-noinfo

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 11

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BCB171F0-5C1B-48AE-831E-711510AA3BB9",
            "versionEndExcluding": "3.9.15",
            "versionStartIncluding": "3.0.0"
          },
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "502743C7-CDF1-4644-8371-FFB97DE1A4E6",
            "versionEndExcluding": "4.14.15",
            "versionStartIncluding": "4.0.0"
          },
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EA89FA02-0C55-47CE-8B8B-4A383F6F2E65",
            "versionEndExcluding": "5.6.17",
            "versionStartIncluding": "5.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]