CVE-2025-32432

Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.0.0-RC1 through 3.9.14 Craft CMS versions 4.0.0-RC1 through 4.14.14 Craft CMS versions 5.0.0-RC1 through 5.6.16

Description Craft CMS contains a critical issue related to improper code generation management, allowing unauthenticated remote attackers to execute arbitrary code. This high-impact, low-complexity attack vector has been exploited in the wild by the Mimo intrusion set. Attackers use specially crafted GET requests to deploy webshells, which then facilitate the installation of malicious payloads including cryptominers (such as XMRig), proxyware (such as IPRoyal), and loaders. In some cases, a dynamically linked library named alamdar.so is used to hide malicious processes from system lists. Over 28,000 exposed instances have been identified worldwide.

Recommendations Update Craft CMS versions 3.0.0-RC1 through 3.9.14 to version 3.9.15. Update Craft CMS versions 4.0.0-RC1 through 4.14.14 to version 4.14.15. Update Craft CMS versions 5.0.0-RC1 through 5.6.16 to version 5.6.17.