PT-2025-17927 · Craft · Craft

Nicolas Bourras + 2 · Published 2025-04-25 · Updated 2026-03-31 · CVE-2025-32432

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 3.9.15 Craft CMS versions prior to 4.14.15 Craft CMS versions prior to 5.6.17

Description Craft CMS is vulnerable to remote code execution. This is a high-impact, low-complexity issue actively exploited by the Mimo threat actor. The Mimo group has been observed deploying webshells, cryptominers (XMRig), and proxyware (IPRoyal) by exploiting this vulnerability. The exploitation involves deploying a webshell via a specially crafted GET request, allowing for arbitrary command execution on the compromised server. The attackers employ techniques to hide their malicious activity, including the use of the alamdar.so library. Approximately 13,000 vulnerable instances have been identified, with around 300 already compromised. The attackers are financially motivated and have demonstrated a diversification of tactics, including the potential for ransomware deployment.

Recommendations Craft CMS versions prior to 3.9.15: Update to version 3.9.15 or later. Craft CMS versions prior to 4.14.15: Update to version 4.14.15 or later. Craft CMS versions prior to 5.6.17: Update to version 5.6.17 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-06516

CVE-2025-32432

GHSA-F3GW-9WW9-JMC3

Affected Products

Craft

References · 169

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32432.json · Exploit
• 🔥 https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms · Exploit
• 🔥 https://exploit-db.com/exploits/52525 · Exploit
• https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47 · Patch
• https://bdu.fstec.ru/vul/2025-06516 · Security Note
• https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-32432 · Security Note
• https://osv.dev/vulnerability/GHSA-f3gw-9ww9-jmc3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32432 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 · Vendor Advisory, Security Note
• https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical · Note
• https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical · Note
• https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g · Note