# CVE-2025-32432: Craft CMS - RCE

> Live exploitation tracking for CVE-2025-32432 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-32432

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Craftcms CMS
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** cms

## Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

## CrowdSec analysis

[CVE-2025-32432](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-32432) is a critical vulnerability affecting Craft CMS, enabling remote code execution through specially crafted requests to the asset generation functionality within the admin panel.

CrowdSec has been tracking this vulnerability and its exploits since 20th of May 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-32432 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-32432 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-32432 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts are typically associated with requests to URLs containing `/index.php?p=admin/actions/assets/generate-transform`.

## Timeline

- 2025-04-25: CVE Published. CVE-2025-32432 is published to NVD.
- 2025-05-20: Rule Released. CrowdSec releases a rule to detect CVE-2025-32432 exploitation attempts against the CrowdSec Network.
- 2025-05-20: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-32432 for the first time.
- 2026-03-20: CISA KEV. CVE-2025-32432 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-04-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
- https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47
- https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical
- https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32432.yaml
- https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-32432) follows observed exploitation activity for CVE-2025-32432. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.