Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2025-32432

Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

POC

Reference

- https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/

Github

- https://github.com/ARPSyndicate/cve-scores

- https://github.com/B1ack4sh/Blackash-CVE-2025-32432

- https://github.com/Bruter1/Acunetix

- https://github.com/CTY-Research-1/CVE-2025-32432-PoC

- https://github.com/Chocapikk/CVE-2025-32432

- https://github.com/Chocapikk/msf-exploit-collection

- https://github.com/Orange-Cyberdefense/CVE-repository

- https://github.com/Ostorlab/KEV

- https://github.com/PuddinCat/GithubRepoSpider

- https://github.com/Sachinart/CVE-2025-32432

- https://github.com/Threekiii/CVE

- https://github.com/a1batr0ssG/VulhubExpand

- https://github.com/apostolovd/PoCs

- https://github.com/bambooqj/CVE-2025-32432

- https://github.com/craftcms/security-patches

- https://github.com/fkie-cad/nvd-json-data-feeds

- https://github.com/nomi-sec/PoC-in-GitHub

- https://github.com/plzheheplztrying/cve_monitor

- https://github.com/tanjiti/sec_profile