CriticalGHSA-f3gw-9ww9-jmc3CVE-2025-32432

Craft CMS Allows Remote Code Execution

Published 25 Apr 2025 · Updated 20 Mar 2026

Affected packages

craftcms/cmsComposer

Affected: >=3.0.0-RC1 <3.9.15
Fixed in: 3.9.15

Update to the fixed version for your release line, for example:composer require craftcms/cms:^3.9.15

craftcms/cmsComposer

Affected: >=4.0.0-RC1 <4.14.15
Fixed in: 4.14.15

Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.14.15

craftcms/cmsComposer

Affected: >=5.0.0-RC1 <5.6.17
Fixed in: 5.6.17

Update to the fixed version for your release line, for example:composer require craftcms/cms:^5.6.17

Details

Impact

This is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g

This is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version.

Details

https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432

References

https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47

https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical

https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/

Credits

Credit to Orange Cyberdefense for discovering a reporting this bug.

Is GHSA-f3gw-9ww9-jmc3 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.