In CISA KEV10.0 CriticalCWE-94
CVE-2025-32432
Craft CMS Code Injection Vulnerability
Status
- Exploited in the wild
- In CISA KEV since 20 Mar
Federal deadlineFri 3 Apr, 23:59 UTC
Passed 204 days ago
CISA KEV · added 20 Mar
Exploit probabilityEPSSchecked 21 Oct
99.7%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
10.0Critical
Description NVD
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 5 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 20 Mar · 15:52 UTC | CISA | CISA Adds CVE-2025-32432 to Known Exploited Vulnerabilities Catalogue |
| Fri 20 Mar · 16:23 UTC | CISA | CISA Adds CVE-2025-32432 to Known Exploited Vulnerabilities Catalogue |
| Fri 20 Mar · 16:55 UTC | CISA | CISA Adds Five Known Exploited Vulnerabilities to Catalog |
| Sat 21 Mar · 09:11 UTC | The Hacker News | CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026 |
| Sun 22 Mar · 15:13 UTC | Security Affairs | U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog |
- U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026The Hacker News · mentions it in passing
- CISA Adds Five Known Exploited Vulnerabilities to CatalogCISA · official notice · mentions it in passing
- CISA Adds CVE-2025-32432 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- CISA Adds CVE-2025-32432 to Known Exploited Vulnerabilities CatalogueCISA · first in our coverage · official notice