Firetruck

CVE-2025-32432

KEV
Updated Mar 21, 2026 · PUBLISHED
View KEV entry →

Description

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.

Full record on cve.org →

Affected packages

PackageVendor / ProductVersion rangeStatus
cmscraftcms / cms>= 3.0.0-RC1, < 3.9.15affected
cmscraftcms / cms>= 4.0.0-RC1, < 4.14.15affected
cmscraftcms / cms>= 5.0.0-RC1, < 5.6.17affected