CVE-2025-32432: craftcms craft cms

csirt@kutim:~/threat-intel/cve/CVE-2025-32432

CVSS 10.0 · Critical KEV · sudah dieksploitasi EPSS 99,8%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada craftcms craft cms. Skor CVSS 3.1 10.0 (Critical) menurut NVD. Masuk katalog KEV CISA pada 20 Maret 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

Rincian

Terbit di NVD: 25 April 2025
Terakhir diubah: 24 September 2026
Status NVD: Analyzed
CVSS 3.1: 10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari): 99,8% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Craft CMS Code Injection Vulnerability
Masuk KEV: 20 Maret 2026
Tenggat CISA: 3 April 2026 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
craftcms	craft cms	Versi 3.0.0 hingga sebelum 3.9.15
craftcms	craft cms	Versi 4.0.0 hingga sebelum 4.14.15
craftcms	craft cms	Versi 5.0.0 hingga sebelum 5.6.17

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 advisory vendor
https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47 patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432 pemerintah AS
https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ exploit · press/media coverage
https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical product · release notes
https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical product · release notes
https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical product · release notes

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.