CVE-2025-32432
KEVCRITICAL 10.0EPSS 99.8%
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
- CVSS v3.1
- 10.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS v3.1
- 10.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L - CVSS v3.1
- 10.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L - EPSS
- 99.84% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2026-03-20
- Nuclei
- critical · CWE-94
- Published
- 2025-04-25
- Updated
- 2026-03-21
Proof-of-concept exploits (14)
- CTY-Research-1/CVE-2025-32432-PoC6★ · 2025-08-29
- Chocapikk/CVE-2025-3243210★ · 2025-04-27
- Sachinart/CVE-2025-3243227★ · 2025-04-27
- apostolovd/PoCs1★ · 2026-06-04
- bambooqj/CVE-2025-324322★ · 2025-09-23
- EzraMansor/CVE-2025-32432-PoC
- HeltonPojo/CVE-2025-32432
- TheMursalin/CVE-2025-32432
- c0gnit00/CVE-2025-32432
- cd-ratel/CVE-2025-32432
- n40y/PoC_CVE-2025-32432
- theeomega/CVE-2025-32432-POC
- Acczdy/CVE-Vault
- Collinformatics/HTB-Orion