Craft CMS Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2025-32432)

1. Apply Official Security Patches

Immediately upgrade your Craft CMS dependency to the designated secure release using Composer.

# Run the following command in your project root directory:
composer update craftcms/cms

• Craft 3.x Users: Upgrade to 3.9.15 or higher
• Craft 4.x Users: Upgrade to 4.14.15 or higher
• Craft 5.x Users: Upgrade to 5.6.17 or higher

2. Temporary Mitigations (If patching is delayed)

• WAF (Web Application Firewall) Rules: Deploy custom WAF signatures to detect and block suspicious PHP function calls and payload patterns targeting Craft CMS endpoints.
• Principle of Least Privilege: Ensure that the PHP-FPM and web server (Nginx/Apache) processes run with minimal privileges (e.g., www-data) and restrict execution permissions on writable directories.

CVE-2025-32432 is a critical Remote Code Execution (RCE) vulnerability in Craft CMS. This issue stems from an incomplete fix or bypass of the previously addressed CVE-2023-41892 vulnerability.

An unauthenticated attacker can exploit this vulnerability with low complexity. By leveraging improper input validation and code injection mechanisms (CWE-94), the attacker can trigger arbitrary PHP code execution on the server side. Due to active exploitation in the wild, this vulnerability has been added to the CISA KEV (Known Exploited Vulnerabilities) catalog and carries an extremely high EPSS score of 0.94.

Successful exploitation allows attackers to execute system commands under the context of the web server process, potentially leading to web shell deployment, database exfiltration, lateral movement, and full infrastructure compromise.