CVE-2025-32432: Craft CMS Code Injection Vulnerability

Executive Summary

A critical code injection vulnerability (CVE-2025-32432) has been identified in Craft CMS, a widely used PHP-based content management system. The flaw allows a remote, unauthenticated attacker to execute arbitrary code on the server hosting the affected Craft CMS installation.

On March 20, 2026, CISA added CVE-2025-32432 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Federal Civilian Executive Branch (FCEB) agencies are required to remediate the vulnerability by the mandated deadline. All organizations running Craft CMS should treat this as an urgent, high-priority patch.

Vulnerability Overview

Affected Versions

Administrators should consult the official Craft CMS security advisory and update to the latest patched release without delay.

Technical Analysis

Root Cause

The vulnerability exists in Craft CMS's handling of user-controlled input that is passed into code generation or execution pathways without sufficient validation or sanitization. This is classified as CWE-94 (Code Injection) — a class of vulnerabilities where attacker-supplied data is interpreted and executed as code by the application.

In Craft CMS's case, the flaw allows an unauthenticated attacker to craft a malicious request that causes the server to execute arbitrary PHP or system-level code, resulting in complete server compromise.

Attack Flow

1. Attacker identifies a publicly reachable Craft CMS installation
2. No authentication or valid account is required
3. Attacker crafts a malicious HTTP request containing an injection payload
4. Craft CMS processes the request and passes attacker-controlled data
   into a code generation or evaluation routine without proper sanitization
5. The injected code executes in the context of the web server process
6. Attacker achieves arbitrary code execution on the underlying server
7. Post-exploitation: webshell deployment, data exfiltration, lateral movement

Why This Is Critical

Impact Assessment

Immediate Remediation

Step 1: Update Craft CMS Immediately

Apply the latest Craft CMS security update as published in the official Craft CMS changelog and security advisory:

# Update via Composer (recommended method)
composer update craftcms/cms
 
# Verify the installed version after update
php craft --version

Alternatively, use the Craft CMS control panel to apply available updates via Utilities > Updates.

Step 2: Verify Your Installation Is Patched

# Check installed Craft CMS version
composer show craftcms/cms | grep versions
 
# Confirm against the fixed version in the vendor advisory

Step 3: Scan for Indicators of Compromise

# Check for unexpected PHP files in the web root and storage directories
find /path/to/craftcms/ -name "*.php" -newer /path/to/craftcms/composer.json \
  -not -path "*/vendor/*" -not -path "*/storage/runtime/*" -type f
 
# Look for PHP files in upload or storage directories (should not exist)
find /path/to/craftcms/web/uploads/ -name "*.php" -o -name "*.phtml"
find /path/to/craftcms/storage/ -name "*.php" -type f
 
# Review recent web server access logs for anomalous POST requests
grep -E "POST.*(index\.php|actions/)" /var/log/nginx/access.log | tail -200

Step 4: Restrict Access While Patching

If immediate patching is not possible, consider temporarily blocking public access to the Craft CMS control panel and taking the site offline until the patch can be applied:

# Nginx — block Craft CMS admin panel temporarily
location /admin {
    deny all;
    return 403;
}
 
location /index.php/actions {
    deny all;
    return 403;
}

Step 5: Harden the Environment Post-Patching

# Ensure PHP execution is blocked in upload directories
# Add to web server config or .htaccess:
# <FilesMatch "\.php$">
#     Order Deny,Allow
#     Deny from all
# </FilesMatch>
 
# Regenerate Craft CMS security key
php craft setup/security-key
 
# Invalidate all active user sessions
php craft users/invalidate-sessions

Detection Indicators

Post-Remediation Checklist

1. Update Craft CMS to the latest patched version
2. Verify the updated version matches the fixed release in the vendor advisory
3. Audit PHP files across the web root for unexpected additions or modifications
4. Review admin user accounts — remove any unauthorized accounts
5. Reset all admin passwords and regenerate the Craft security key
6. Invalidate all active sessions to force re-authentication of all users
7. Scan upload and storage directories for PHP files that should not exist
8. Review access logs for POST requests to Craft action endpoints prior to patching
9. Deploy a WAF rule to detect and block code injection patterns in HTTP requests
10. Enable two-factor authentication on all Craft CMS administrator accounts
11. Notify your incident response team if compromise indicators are found
12. Monitor for re-exploitation until confirmed patched across all environments

References

• NVD — CVE-2025-32432
• CISA Known Exploited Vulnerabilities Catalog
• Craft CMS Security Advisory