Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.

A critical code injection vulnerability has been identified in Craft CMS, tracked as CVE-2025-32432. This security flaw allows remote attackers to execute arbitrary code on affected systems. The vulnerability poses a high risk to organizations using Craft CMS installations. Security advisories have been published by the Craft CMS team and security researchers. The issue has been documented in multiple sources including GitHub security advisories and the National Vulnerability Database. Organizations using Craft CMS should immediately review the security advisories and apply available patches or mitigations.