CVE-2025-32432: Craft CMS Code Injection -- Remote Code Execution

Background

Craft CMS is a popular, developer-friendly content management system built on PHP, used by agencies, publishers, and organisations worldwide to power websites and web applications. It is notable for its flexibility, clean templating via the Twig template engine, and a GraphQL API. Craft CMS installations underpin a significant number of public-facing websites, often storing customer data, e-commerce information, and sensitive content.

CMS platforms are an attractive attack target for several reasons: they are internet-facing by design, commonly deployed by organisations with limited security resources (agencies and small businesses), and a successful exploitation of a code injection vulnerability typically yields server-level code execution. CISA added CVE-2025-32432 to the KEV catalogue on 2026-03-20. Given Craft CMS’s global deployment footprint, this vulnerability affected a large number of public-facing websites.

Technical Mechanism

CVE-2025-32432 is a server-side code injection vulnerability in Craft CMS. Code injection in PHP-based CMSes typically arises from one of several root causes:

• Template injection: Twig templates that incorporate unsanitised user input can be exploited if template rendering is performed on user-controlled strings; Twig provides a sandbox mode, but bypasses are known
• Unsafe deserialisation: PHP’s unserialize() function, if called on user-controlled input, can trigger PHP object injection leading to code execution via gadget chains
• Dynamic file inclusion: CMS functionality that includes PHP files based on user-controlled paths can be abused to include attacker-controlled files
• Plugin/extension attack surface: CMS plugins with their own vulnerabilities can extend the attack surface

In Craft CMS, the specific vector involves user-supplied input being processed in a way that allows PHP code or template expressions to be injected and evaluated. The attack flow is:

1. An attacker sends a crafted HTTP request to a Craft CMS endpoint — this may be a form submission, GraphQL query, or API request
2. The input is processed and incorporated into a PHP code path or template rendering call without adequate sanitisation
3. The injected code executes in the PHP process context, with the permissions of the web server user (e.g., www-data)
4. The attacker achieves RCE, enabling webshell installation, data exfiltration, or pivot to other services

Real-World Exploitation Evidence

CVE-2025-32432 was added to CISA KEV on 2026-03-20. The exploitation of CMS code injection vulnerabilities follows well-established patterns:

• Mass exploitation campaigns — CMS vulnerabilities are frequently targeted by automated scanning and exploitation tools, enabling mass compromise of thousands of sites within days of public disclosure
• SEO spam and malware distribution — compromised CMS installations are used to inject spam content, serve malware to visitors, or participate in click fraud networks
• Credential harvesting — CMS databases often contain customer email addresses, hashed passwords, and payment data; initial access via code injection is followed by database exfiltration
• Webshell deployment — persistent PHP webshells are commonly installed following CMS exploitation, enabling long-term access even after CMS patching

Impact Assessment

CVE-2025-32432 requires no authentication, placing every internet-accessible Craft CMS installation in scope for exploitation. A successful attack achieves PHP code execution under the web server process identity (typically www-data), which grants read access to the Craft application directory and database credentials stored in configuration files. From this position, an attacker can dump the CMS database (containing user records, email addresses, and potentially payment data), install persistent PHP web shells, and pivot to other services reachable from the web server. The 9.8 CVSS score is appropriate given the unauthenticated remote code execution outcome.

The scale of the business impact depends heavily on the site’s role and data exposure, but the pattern for CMS exploitation is consistent: initial mass exploitation by automated tools targets all reachable instances, followed by opportunistic credential harvesting, SEO spam injection, and in some cases delivery of malware to site visitors. Craft CMS is commonly deployed by digital agencies managing multiple client websites from a single installation — in these cases, compromise of the CMS server can affect multiple clients simultaneously. For e-commerce or customer-facing deployments, the regulatory consequences of a database breach (GDPR, PCI-DSS depending on payment handling) compound the direct operational impact.

Affected Versions

Consult the Craft CMS GitHub repository and official security advisories for precise version numbers.

Remediation Steps

1. Update Craft CMS to the latest patched version using Composer:

   composer update craftcms/cms
   ./craft update

2. Run Craft CMS’s built-in security check after updating
3. Search the web root for unexpected PHP files, particularly in upload directories:

   find /var/www/html -name "*.php" -newer /var/www/html/craft -type f

4. Review web server access logs for exploitation indicators (unusual POST requests to Craft endpoints, web shell access patterns)
5. Rotate the Craft CMS security key (CRAFT_SECURITY_KEY / securityKey in config)
6. Change passwords for all Craft CMS administrative accounts
7. Rotate any database credentials, API keys, or third-party integration tokens stored in Craft configuration
8. Check the database for unauthorised admin account creation
9. Enable a web application firewall (WAF) rule targeting code injection patterns if immediate patching is not possible

Detection Guidance

Web server access logs (Apache/Nginx) — look for:

• POST requests to unusual Craft endpoints (not standard CMS paths)
• Requests containing PHP code patterns in parameter values (<?php, eval(, base64_decode()
• Access to newly created .php files in content upload directories

Craft CMS logs — storage/logs/web-YYYY-MM-DD.log:

• PHP exceptions containing class names associated with PHP deserialization gadget chains
• Template rendering errors that may indicate template injection attempts

SIEM query example (Splunk):

index=web_logs sourcetype=nginx_access
| search cs_uri_query="*eval(*" OR cs_uri_query="*base64_decode*" OR cs_uri_query="*system(*"
| stats count by c_ip, cs_uri_stem, cs_uri_query
| sort -count

Filesystem monitoring:

• New .php files in web-accessible directories (especially upload/asset directories)
• Modified core Craft CMS files (composer.json hash changes, module file modifications)

Timeline

References

• NVD — CVE-2025-32432
• CISA KEV — CVE-2025-32432
• MITRE CVE — CVE-2025-32432