Craft CMS - RCE (CVE-2025-32432)
Description
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
psychologyCrowdSec Analysis
CVE-2025-32432 is a critical vulnerability affecting Craft CMS, enabling remote code execution through specially crafted requests to the asset generation functionality within the admin panel.
CrowdSec has been tracking this vulnerability and its exploits since 20th of May 2025.
CrowdSec network data shows that most actors exploiting CVE-2025-32432 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-32432 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-32432 is currently experiencing high visibility and active exploitation across the internet.
Exploitation attempts are typically associated with requests to URLs containing /index.php?p=admin/actions/assets/generate-transform.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-04-25 |
| Rule Released | 2025-05-20 |
| CrowdSec First Seen | 2025-05-20 |
| CISA KEV | 2026-03-20 |
| CISA Remediation Deadline | 2026-04-03 |
Remediation & Protection
External References
- https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
- https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47
- https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical
- https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32432.yaml
- https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/