Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025
Attackers used CVE-2025-32432 to compromise Craft CMS websites before its April 2025 fixes, with further attacks reported in 2026. Ask your website manager to update and check for compromise; Craft 5 also needs the later related fix in 5.10.12.
If your family or business runs a Craft CMS website, ask its developer or hosting provider to install the latest supported release: the original fixes are 3.9.15, 4.14.15 and 5.6.17, with 5.10.12 needed for the later related Craft 5 flaw. Ask them to check for compromise and, if found, take the site offline, remove backdoors and replace exposed keys and database credentials before restoring access.
What’s happening
CVE-2025-32432 lets an attacker without a login run code on a vulnerable Craft CMS website’s server through its image-transformation feature. It affects website operators running vulnerable Craft CMS 3, 4 or 5 releases. Orange Cyberdefense documented exploitation before patches, and told BleepingComputer that attackers installed backdoors and stole data. Craft released fixes in 3.9.15, 4.14.15 and 5.6.17 on 10 April 2025. CISA listed the flaw as exploited on 20 March 2026; Australia’s ACSC reported further exploitation in a wider website campaign in July. In August, Craft disclosed a related, separate code-execution route requiring an editor login, fixed in Craft 5.10.12. That advisory does not say whether attackers exploited the later route. As at 3 November 2026, the original flaw has fixes across all three affected branches, but updating does not remove backdoors or undo stolen credentials on an already compromised server.
- What
- Flaw
- Affects
- Craft CMS website software
- Affected
- Craft CMS >= 3.0.0-RC1, <= 3.9.14
Craft CMS >= 4.0.0-RC1, <= 4.14.14
Craft CMS >= 5.0.0-RC1, <= 5.6.16 - Fixed in
- Craft CMS 3.9.15
Craft CMS 4.14.15
Craft CMS 5.6.17 - Since
- 20 Mar 2026
- Closed
- 25 Aug 2026
Timeline
- Vendor revised
Craft disclosed a related route to code execution requiring a logged-in editor with access to an asset library. Its separate advisory lists Craft CMS 5 releases before 5.10.12 as affected and 5.10.12 as patched.
- Wider attacks
Australia’s ACSC included CVE-2025-32432 among flaws exploited in a global website-compromise campaign affecting Australian businesses. Attackers were installing backdoors on web servers.
- CISA added
CISA added CVE-2025-32432 to its Known Exploited Vulnerabilities catalogue, as subsequently confirmed by the Canadian Centre for Cyber Security.
- Made public
Craft published its GitHub security advisory for CVE-2025-32432, identifying affected releases across Craft CMS 3, 4 and 5 and rating the flaw critical.
- Wider attacks
Craft found evidence suggesting exploitation and emailed potentially affected licence holders, urging updates.
- New fixFixed
Craft released versions 3.9.15, 4.14.15 and 5.6.17 with an application-level fix, marking the updates as critical.
- Update
Craft received the vulnerability report and confirmed that its software was affected.
- UpdateNo fix yet
Orange Cyberdefense dates a confirmed Craft CMS server compromise to 14 February 2025, before fixes were available.
Sources
- Remote Code Execution — GHSA-f3gw-9ww9-jmc3Craft CMS · 24 Apr 2025
- Craft CMS and CVE-2025-32432Craft CMS
- Investigating an in-the-wild campaign using RCE in CraftCMSOrange Cyberdefense SensePost · 18 Apr 2025
- Craft CMS RCE exploit chain used in zero-day attacks to steal dataBleepingComputer · 25 Apr 2025
- Craft CMS security advisory (AV25-300) – Update 1Canadian Centre for Cyber Security · 23 Mar 2026
- Large-scale exploitation campaign targeting website content management systems (CMS)Australian Cyber Security Centre · 9 July 2026
- Remote Code Execution by non-admin authenticated userCraft CMS · 25 Aug 2026