CVE-2025-32432

The vulnerability classified as CWE-94 (code injection) allows an unauthenticated attacker to remotely execute arbitrary code on the server hosting Craft CMS. The attack is characterized by low complexity and requires no user interaction or possession of an account in the system. This is an additional patch for the previously reported CVE-2023-41892 vulnerability, indicating incomplete removal of the original attack vector.

Attackers can remotely execute arbitrary code on the server, which in practice means complete takeover of the application and potentially the entire system, data theft, backdoor installation, or further lateral movement in the network.

Craft CMS must be immediately updated to version 3.9.15, 4.14.15, or 5.6.17 (released 2025-04-10). Due to active exploitation in production environments, the update should be treated as urgent and performed immediately.

Craft CMS in versions: 3.0.0-RC1 through before 3.9.15, 4.0.0-RC1 through before 4.14.15, and 5.0.0-RC1 through before 5.6.17

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.