CVE-2025-32432
CriticalPublished
Craft CMS Allows Remote Code Execution
- Published
- Apr 25, 2025
- Updated
- Mar 21, 2026
- Assigning CNA
- GitHub_M
- Evidence observed
- Mar 20, 2026
Primary CVSS
10.0/ 10Critical
Craft CMS Allows Remote Code Execution
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LHigh · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
craftcms/CVE-2025-32432
CraftCMS Yii Class Injection Remote Code Execution (CVE-2025-32432)
modules/exploits/linux/http/craftcms_preauth_rce_cve_2025_32432.rb
http/cves/2025/CVE-2025-32432.yaml
AI修复生成的CVE-2025-32432的poc
Exploit, POC for CVE-2025-32432, CraftCMS2Shell
Working PoC for CVE-2025-32432 - Craft CMS <= 5.6.16 unauthenticated RCE via Yii2 PhpManager gadget + nginx access.log poisoning
Python exploit for CVE-2025-32432, a pre-auth RCE in CraftCMS asset-transform endpoint. Includes a two-packet chain to execute arbitrary shell commands via deserialization gadgets.
Pre-auth RCE exploit for Craft CMS in Go. Grabs session/CSRF token, poisons PHP session, triggers deserialization for command execution or reverse shell.
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.
CraftCMS CVE-2025-32432 - Clean PoC
This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution (RCE) vulnerability affecting CraftCMS versions 4.x and 5.x. The vulnerability exists in the asset transform generation feature of CraftCMS.
Single-target proof of concept for CVE-2025-32432, a pre-authentication remote code execution in Craft CMS. Performs vulnerability confirmation via phpinfo gadget and optional command execution through a session-file include chain.
Exploit for Craft CMS pre-authentication RCE (CVE-2025-32432) chaining session poisoning with insecure deserialization to execute arbitrary commands on vulnerable servers.
Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail
A simple PoC on the Remote Code Execution (RCE) Vulnerability of CraftCMS designated as CVE-2025-32432 written in Go
Python PoC exploiting CVE-2025-32432, an unauthenticated RCE in Craft CMS via Yii DI gadget injection, with assetId scanning, reverse shell, and remediation guidance.
Craft CMS CVE-2025-32432 command runner adapted from Nicolas Bourras and Orange Cyberdefense research
banyamer · multiple · Apr 29, 2026