CVE-2025-32432: Craft CMS Code Injection Vulnerability
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
Overview
Craft CMS contains a code injection flaw in its image transformation endpoint that allows an unauthenticated remote attacker to execute arbitrary code on the server. The weakness originates in the underlying Yii framework's object instantiation mechanism and affects all installations running versions 3.0.0-RC1 through below 3.9.15, 4.0.0-RC1 through below 4.14.15, and 5.0.0-RC1 through below 5.6.17. Active exploitation has been observed in the wild, with attackers deploying PHP file managers and webshells to achieve full server compromise.
Vulnerability details
The vulnerable endpoint, actions/assets/generate-transform, accepts POST request bodies that are passed into Yii's object instantiation logic without adequate sanitization. When a request body contains a __class key, the framework constructs a PHP object from attacker-supplied parameters at the point the image transformation object is created. This is a classic code injection pattern under CWE-94: attacker-controlled data crosses a trust boundary and is evaluated as executable code rather than treated as inert input. The flaw is described as an additional fix for CVE-2023-41892, indicating a prior related patch was incomplete.
An attacker sends unauthenticated POST requests to the actions/assets/generate-transform endpoint with a body containing a __class key and attacker-chosen class parameters. Against v4.x and v5.x installations, no meaningful precondition exists beyond network reachability, since the transformation object is constructed before the asset ID is validated. Against v3.x, the attacker must first identify a valid asset ID by incrementing the assetId parameter and observing whether the server returns HTTP 302 (valid) or HTTP 404 (invalid). Confirmed in-the-wild attacks used this path to download a PHP file manager, then upload additional webshells, yielding persistent server access.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review web server access logs and Craft CMS logs under
CRAFT_INSTALL_PATH/storage/logs/for POST requests toactions/assets/generate-transformcontaining the string__classin the request body; presence indicates at minimum active scanning, and may indicate exploitation. - Look for sequential POST requests to the
actions/assets/generate-transformendpoint with incrementingassetIdvalues from a single source IP, which indicates an attacker enumerating valid asset IDs as a precursor to exploitation on v3.x instances. - Audit the filesystem for unexpected PHP files in asset upload directories and public HTML folders that are absent from source control, as confirmed post-exploitation activity involved dropping PHP file managers and webshells in these locations.
Remediation
Additional hardening
- Upgrade Craft CMS to 3.9.15 or later (v3.x installs), 4.14.15 or later (v4.x installs), or 5.6.17 or later (v5.x installs); see the vendor advisory in References for full release details.
- Block POST requests to the
actions/assets/generate-transformendpoint at the web application firewall or reverse proxy layer when the request body contains the string__class; the vendor explicitly identifies this as the malicious payload indicator. - If immediate patching is not possible, install the Craft CMS Security Patches library as a temporary stop-gap, then take the site offline before cleaning any discovered payloads, since automated re-infection can occur within seconds of cleanup on an unpatched instance.
- After any suspected compromise, rotate the
CRAFT_SECURITY_KEYenvironment variable, database credentials, and any other secrets stored as environment variables, and force a password reset for all CMS users before restoring public access.
Key dates
References
- https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
- https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432
- https://nvd.nist.gov/vuln/detail/CVE-2025-32432
- https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
- https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47
- https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical
- https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical
- https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical
Frequently asked questions
Does CVE-2025-32432 affect my FedRAMP authorization?
If Craft CMS runs inside your authorization boundary, yes. CVE-2025-32432 is listed in CISA's Known Exploited Vulnerabilities catalog, and its remediation deadline of April 3, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in your boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can already see. At this point, you either remediate it now or formally document the mitigation and the delay.
How does Knox help me handle CVE-2025-32432?
Knox does not patch your software. Remediating Craft CMS is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage that help you document the fix for your next assessment. The remediation work is yours to carry out; maintaining a defensible compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a CVE like CVE-2025-32432, that means exposure surfaces during continuous monitoring rather than waiting until an assessor flags it at a scheduled review.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2025-32432's remediation deadline of April 3, 2026 has passed. What happens now?
If CVE-2025-32432 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out now and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid footing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
