Dashboard / CVE-2025-32432

CVE-2025-32432

CISA KEV
ACT NOW Priority: 0.00 BB Relevance: 10/100
Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.

CISA Known Exploited Vulnerability

Vendor / Product Craft CMS — Craft CMS
Date Added 2026-03-20
Remediation Due 2026-04-03
https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432 ; https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 ; https://nvd.nist.gov/vuln/detail/CVE-2025-32432

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
craftcms craft_cms 3.0.0 – 3.9.15
craftcms craft_cms 4.0.0 – 4.14.15
craftcms craft_cms 5.0.0 – 5.6.17

References & Advisories (7)

Bug Bounty Relevance

10 / 100
✓ Known exploited (KEV)
✓ High exploitation probability

CVSS Score

Unscored

EPSS — Exploitation Probability

99.79%
Raw Score 0.997920
Percentile 100.0%
Date 2026-10-28

Intelligence Sources

kev ref →

External Links