{"id":"craft-cms-code-execution-mar-2026","category":"patch","status":"closed","title":"Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025","tldr":"Attackers used CVE-2025-32432 to compromise Craft CMS websites before its April 2025 fixes, with further attacks reported in 2026. Ask your website manager to update and check for compromise; Craft 5 also needs the later related fix in 5.10.12.","summary":"CVE-2025-32432 lets an attacker without a login run code on a vulnerable Craft CMS website’s server through its image-transformation feature. It affects website operators running vulnerable Craft CMS 3, 4 or 5 releases. Orange Cyberdefense documented exploitation before patches, and told BleepingComputer that attackers installed backdoors and stole data. Craft released fixes in 3.9.15, 4.14.15 and 5.6.17 on 10 April 2025. CISA listed the flaw as exploited on 20 March 2026; Australia’s ACSC reported further exploitation in a wider website campaign in July. In August, Craft disclosed a related, separate code-execution route requiring an editor login, fixed in Craft 5.10.12. That advisory does not say whether attackers exploited the later route. As at 3 November 2026, the original flaw has fixes across all three affected branches, but updating does not remove backdoors or undo stolen credentials on an already compromised server.","action":"If your family or business runs a Craft CMS website, ask its developer or hosting provider to install the latest supported release: the original fixes are 3.9.15, 4.14.15 and 5.6.17, with 5.10.12 needed for the later related Craft 5 flaw. Ask them to check for compromise and, if found, take the site offline, remove backdoors and replace exposed keys and database credentials before restoring access.","product":"Craft CMS website software","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-32432"],"tags":["craft-cms","website","code-injection","remote-code-execution","actively-exploited"],"affected":["Craft CMS >= 3.0.0-RC1, <= 3.9.14","Craft CMS >= 4.0.0-RC1, <= 4.14.14","Craft CMS >= 5.0.0-RC1, <= 5.6.16"],"fixed":["Craft CMS 3.9.15","Craft CMS 4.14.15","Craft CMS 5.6.17"],"matches":[],"sources":[{"kind":"advisory","title":"Remote Code Execution — GHSA-f3gw-9ww9-jmc3","url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3","by":"Craft CMS","date":"2025-04-24"},{"kind":"advisory","title":"Craft CMS and CVE-2025-32432","url":"https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432","by":"Craft CMS","date":""},{"kind":"research","title":"Investigating an in-the-wild campaign using RCE in CraftCMS","url":"https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/","by":"Orange Cyberdefense SensePost","date":"2025-04-18"},{"kind":"news","title":"Craft CMS RCE exploit chain used in zero-day attacks to steal data","url":"https://www.bleepingcomputer.com/news/security/craft-cms-rce-exploit-chain-used-in-zero-day-attacks-to-steal-data/","by":"BleepingComputer","date":"2025-04-25"},{"kind":"advisory","title":"Craft CMS security advisory (AV25-300) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/craft-cms-security-advisory-av25-300","by":"Canadian Centre for Cyber Security","date":"2026-03-23"},{"kind":"advisory","title":"Large-scale exploitation campaign targeting website content management systems (CMS)","url":"https://www.cyber.gov.au/alert/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms","by":"Australian Cyber Security Centre","date":"2026-07-09"},{"kind":"advisory","title":"Remote Code Execution by non-admin authenticated user","url":"https://github.com/craftcms/cms/security/advisories/GHSA-9wcj-wqqh-cqvg","by":"Craft CMS","date":"2026-08-25"}],"started":"2026-03-20","closed":"2026-08-25","created":"2026-11-03T22:29:01.094Z","updated":"2026-11-03T22:29:01.094Z","cve_notes":[{"cve":"CVE-2025-32432","name":"Unauthenticated code execution in Craft CMS","what":"A code-injection flaw in Craft CMS’s image-transformation feature allows a remote attacker without a login to run code on the website’s server.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-08-25","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Craft disclosed a related route to code execution requiring a logged-in editor with access to an asset library. Its separate advisory lists Craft CMS 5 releases before 5.10.12 as affected and 5.10.12 as patched.","url":"https://github.com/craftcms/cms/security/advisories/GHSA-9wcj-wqqh-cqvg","by":"Craft CMS","patch":null},{"at":"2026-07-09","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Australia’s ACSC included CVE-2025-32432 among flaws exploited in a global website-compromise campaign affecting Australian businesses. Attackers were installing backdoors on web servers.","url":"https://www.cyber.gov.au/alert/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms","by":"Australian Cyber Security Centre","patch":null},{"at":"2026-03-20","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2025-32432 to its Known Exploited Vulnerabilities catalogue, as subsequently confirmed by the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/craft-cms-security-advisory-av25-300","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2025-04-24","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Craft published its GitHub security advisory for CVE-2025-32432, identifying affected releases across Craft CMS 3, 4 and 5 and rating the flaw critical.","url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3","by":"Craft CMS","patch":null},{"at":"2025-04-17","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Craft found evidence suggesting exploitation and emailed potentially affected licence holders, urging updates.","url":"https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432","by":"Craft CMS","patch":null},{"at":"2025-04-10","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"Craft released versions 3.9.15, 4.14.15 and 5.6.17 with an application-level fix, marking the updates as critical.","url":"https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432","by":"Craft CMS","patch":"patched"},{"at":"2025-04-07","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Craft received the vulnerability report and confirmed that its software was affected.","url":"https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432","by":"Craft CMS","patch":null},{"at":"2025-02-14","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Orange Cyberdefense dates a confirmed Craft CMS server compromise to 14 February 2025, before fixes were available.","url":"https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/","by":"Orange Cyberdefense SensePost","patch":"none"}],"url":"https://hard.fyi/live/craft-cms-code-execution-mar-2026/","json":"https://hard.fyi/api/live?id=craft-cms-code-execution-mar-2026"}