CVE-2025-32432: Craft CMS unauthenticated remote code execution (generate-transform)

Exploited in the wild Critical 10.0 EPSS 99.8%

Craft CMS 3, 4 and 5 can be made to run arbitrary code by an unauthenticated attacker; the bug builds on a Yii framework flaw and is an additional fix for CVE-2023-41892. Craft fixed it in 3.9.15, 4.14.15 and 5.6.17 on 10 April 2025 and found evidence of in-the-wild exploitation on 17 April 2025. CISA added it to KEV on 20 March 2026.

CVE-2025-32432CVE identifier
10.0CVSS 3.1 base score (critical)
2026-03-20added to CISA's exploited list (US federal deadline 2026-04-03)
99.8%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
2025-04-25published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run the affected software and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
No restart needed; reload PHP-FPM if you use OPcache.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

Craft CMS 3.0.0-RC1 before 3.9.15
Craft CMS 4.0.0-RC1 before 4.14.15
Craft CMS 5.0.0-RC1 before 5.6.17

Fixed in:

Craft CMS 3.9.15
Craft CMS 4.14.15
Craft CMS 5.6.17

Am I affected?

cd /path/to/craft && composer show craftcms/cms | grep versions

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Built from source

cd /path/to/craft
composer update craftcms/cms
# or: php craft update all

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

Block POST requests to the actions/assets/generate-transform endpoint whose body contains the string __class at your firewall/WAF (Craft).
Last resort: install the Craft CMS Security Patches library as a temporary stop-gap until you can update.

Look for signs of exploitation

Suspicious POST requests to actions/assets/generate-transform with __class in the body mean the site was at least scanned (Craft).
If compromised: take the site offline, remove payloads (often in asset upload folders and public HTML folders), update, refresh the security key (php craft setup/security-key), rotate database and other credentials.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432 ; https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 ; https://nvd.nist.gov/vuln/detail/CVE-2025-32432

Related vulnerabilities

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.