CVE-2025-32432: Craft CMS Code Injection Vulnerability

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code. The issue is tracked as CVE-2025-32432 and is classified under CWE-94. Organizations running this content management system should treat the finding as a priority for investigation and remediation.

How it works

CWE-94 describes improper control over code generation, allowing an attacker to supply input that is later interpreted as executable code. In this case the vulnerability permits remote code execution without requiring prior authentication in the affected Craft CMS installation. An attacker can abuse the flaw by crafting input that the application processes and executes in the context of the web server process.

Am I affected? How to find it in your systems

Craft CMS is typically deployed as a PHP-based web application for content management. Begin by inventorying all internet-facing and internal instances through asset discovery, configuration management databases, or web server logs. Identify installations by checking for characteristic files such as craft/app or the presence of the Craft control panel endpoints. Because exact affected versions are not provided here, compare every detected instance against the vendor advisory to determine whether it is vulnerable. Review web access logs for anomalous requests to administrative or plugin-related endpoints and monitor for unexpected process spawns or file writes originating from the web server user context.

How to remediate

Apply the vendor-supplied update referenced in the official advisory as the primary remediation step. After patching, review and restrict any features that accept untrusted input and are processed by the application’s code-generation paths. Harden the deployment by running the web application under the principle of least privilege, disabling unnecessary PHP functions, and ensuring that file-system permissions prevent the web server user from writing to executable directories.

If you can't patch immediately

• Follow the mitigations documented in the vendor advisory.
• Apply applicable CISA BOD 22-01 guidance for any cloud-hosted instances.
• Segment the Craft CMS servers from other internal systems to limit lateral movement.
• Consider virtual patching or request filtering at a web application firewall to block known malicious patterns associated with this class of flaw.
• Disable or restrict the affected functionality if the business use case permits.
• Discontinue use of the product if no mitigations are available.

If your data may have been exposed

Code injection vulnerabilities that permit remote code execution have been used to establish persistent access and exfiltrate data. Organizations should assume potential compromise until evidence proves otherwise and review authentication logs, file integrity, and outbound network connections from affected systems. Readers can run a free exposure scan of their email addresses against known breach data to check for prior incidents involving their domains.