{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-13T14:19:11.885","vulnerabilities":[{"cve":{"id":"CVE-2025-32432","sourceIdentifier":"security-advisories@github.com","published":"2025-04-25T15:15:36.440","lastModified":"2026-06-17T09:11:59.010","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892."},{"lang":"es","value":"Craft es un CMS flexible e intuitivo para crear experiencias digitales personalizadas en la web y más allá. Desde la versión 3.0.0-RC1 hasta anteriores a la 3.9.15, desde la 4.0.0-RC1 hasta anteriores a la 4.14.15 y desde la 5.0.0-RC1 hasta anteriores a la 5.6.17, Craft es vulnerable a la ejecución remota de código. Este es un vector de ataque de alto impacto y baja complejidad. Este problema se ha corregido en las versiones 3.9.15, 4.14.15 y 5.6.17, y constituye una corrección adicional para CVE-2023-41892."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"craftcms","product":"cms","versions":[{"version":">= 3.0.0-RC1, < 3.9.15","status":"affected"},{"version":">= 4.0.0-RC1, < 4.14.15","status":"affected"},{"version":">= 5.0.0-RC1, < 5.6.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-28T00:00:00+00:00","id":"CVE-2025-32432","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-03-20","cisaActionDue":"2026-04-03","cisaRequiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"Craft CMS Code Injection Vulnerability","weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.9.15","matchCriteriaId":"BCB171F0-5C1B-48AE-831E-711510AA3BB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.14.15","matchCriteriaId":"502743C7-CDF1-4644-8371-FFB97DE1A4E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.6.17","matchCriteriaId":"EA89FA02-0C55-47CE-8B8B-4A383F6F2E65"}]}]}],"references":[{"url":"https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Press/Media Coverage"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}}]}