Skip to content

KEV: Craft CMS code injection (CVE-2025-32432)

Signal: Added to CISA KEV on 2026-03-20 (due 2026-04-03). Craft CMS is exploitable in the wild.

What it is

Craft CMS contains a remote code injection vulnerability that may allow an attacker to execute arbitrary code.

References: - Vendor KB: https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432 - GitHub advisory: https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-32432

Triage (15 minutes)

  1. Identify all Craft CMS deployments and versions.
  2. Determine exposure:
  3. Is the admin panel internet-accessible?
  4. Is the site behind a CDN/WAF?
  5. Collect logs (web server + PHP-FPM/app logs) for the last 30 days.

Mitigation

  • Patch/upgrade immediately to the fixed version(s) referenced by Craft.
  • If patching is blocked:
  • Restrict access to admin and any sensitive endpoints (VPN / IP allowlist).
  • Enable WAF rules for common code-injection/exploitation patterns (defense-in-depth).
  • Ensure the PHP runtime has minimal permissions (no write access where not required).

Hunt / detection

  • Web server logs:
  • Spikes in 4xx/5xx around Craft endpoints
  • Requests with unusual payloads (encoded PHP, template expressions, long querystrings)
  • Host/app:
  • Unexpected new PHP files in webroot
  • Changes to Craft templates/plugins that weren’t deployed
  • Unusual outbound connections from the web host

Recovery notes

  • If exploitation is suspected, treat the web host as compromised.
  • Rotate DB credentials and any Craft-related API keys.
  • Rebuild from known-good artifacts; do not “clean in place.”