According to security researchers at CERT Orange Cyberdefense, a critical remote code execution (RCE) vulnerability in Craft CMS is actively being exploited by threat actors to breach servers and exfiltrate sensitive data.
The vulnerability, tracked as CVE-2025-32432, has been assigned the highest possible CVSS score of 10.0 and affects all Craft CMS versions earlier than 3.9.15, 4.14.15, and 5.6.17.
Craft CMS RCE 0-Day Vulnerability
Researchers uncovered that attackers are leveraging a zero-day exploit chain involving two vulnerabilities.
The first vulnerability (CVE-2025-32432) enables adversaries to send specially crafted requests containing a “return URL” parameter, which gets improperly saved in a PHP session file, setting the stage for further exploitation.
The second vulnerability involves a flaw in the Yii framework (CVE-2024-58136), which Craft CMS relies on, allowing attackers to execute malicious PHP code directly on the server.
The issue was first reported on April 7, 2025, when Craft CMS was informed of a vulnerability related to the Yii framework. Yii addressed the flaw in its 2.0.52 release on April 9.
Craft CMS confirmed the impact shortly after and released patched versions on April 10, implementing an application-level fix.
By April 17, evidence of active exploitation emerged, leading Craft CMS to proactively notify all potentially affected license holders via email.
According to Orange Cyberdefense, attackers have been using this exploit chain to install PHP-based file managers on compromised servers, deploy additional backdoors, and steal sensitive data.
Detection Guidance:
Administrators should review their server logs for suspicious POST requests to the /actions/assets/generate-transform endpoint, especially those containing the string "__class" in the request body—an indicator of potential exploitation.
Mitigation Steps:
- Update immediately to the patched Craft CMS versions.
- For environments where updating is not possible, Craft CMS recommends:
- Blocking suspicious payloads at the firewall level.
- Installing the Craft CMS Security Patches library as a temporary safeguard.
If compromise is suspected:
- Refresh the security key using:
php craft setup/security-key - Rotate all private keys stored in environment variables
- Rotate database credentials
- Force password resets for all users
While Craft Cloud has applied a global firewall block against malicious requests targeting this exploit, users are strongly encouraged to update to the patched versions to ensure full protection.
Notably, this marks the second major Craft CMS vulnerability this year, following CVE-2025-23209, which was added to CISA’s Known Exploited Vulnerabilities catalog in February 2025.
