Craft CMS up to 3.9.14/4.14.14/5.6.16 code injection

Summaryinfo

A vulnerability, which was classified as critical, was found in Craft CMS up to 3.9.14/4.14.14/5.6.16. Affected by this issue is some unknown functionality. The manipulation results in code injection. This vulnerability is reported as CVE-2025-32432. The attack can be launched remotely. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Craft CMS up to 3.9.14/4.14.14/5.6.16. Affected is some unknown functionality. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-32432 since 04/08/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

The exploit is shared for download at exploit-db.com. It is declared as attacked. This issue was added on 03/20/2026 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 04/03/2026:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading to version 3.9.15, 4.14.15 or 5.6.17 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch e1c85441fa47eeb7c688c2053f25419bc0547b47 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Exploit-DB (52525) and Zero-Day.cz (995). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Craft

Name

• CMS

Version

• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4
• 3.9.5
• 3.9.6
• 3.9.7
• 3.9.8
• 3.9.9
• 3.9.10
• 3.9.11
• 3.9.12
• 3.9.13
• 3.9.14
• 4.14.0
• 4.14.1
• 4.14.2
• 4.14.3
• 4.14.4
• 4.14.5
• 4.14.6
• 4.14.7
• 4.14.8
• 4.14.9
• 4.14.10
• 4.14.11
• 4.14.12
• 4.14.13
• 4.14.14
• 5.6.0
• 5.6.1
• 5.6.2
• 5.6.3
• 5.6.4
• 5.6.5
• 5.6.6
• 5.6.7
• 5.6.8
• 5.6.9
• 5.6.10
• 5.6.11
• 5.6.12
• 5.6.13
• 5.6.14
• 5.6.15
• 5.6.16

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion