Craft CMS security advisory (AV25-300) – Update 1

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

  <div>
<div>

        <div><p><strong>Serial number: </strong>AV25-300<br /><strong>Date: </strong>May&nbsp;28, 2025<br /><strong>Updated:</strong> March&nbsp;23, 2026</p>

On April 7, 2025, Craft CMS published a security advisory to address a critical vulnerability in the following product:

  • Craft CMS – versions prior to 9.15, 4.14.15 and 5.6.17

Craft CMS has received reports that CVE-2025‑32432 has been exploited.

Update 1

On March 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025‑32432 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.

</div>

Article Link: Craft CMS security advisory (AV25-300) – Update 1 - Canadian Centre for Cyber Security