---
title: "Craft CMS: known exploited vulnerabilities"
url: https://erroneo.us/security/vendor/craft-cms/
description: "Every Craft CMS vulnerability in CISA's Known Exploited Vulnerabilities catalog since October 2023 (4), newest first, with due dates and fixes."
type: vendor
section: "Security Digest"
date_modified: 2026-03-20
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Craft CMS: known exploited vulnerabilities

- 2026-03-20 [CVE-2025-32432](https://erroneo.us/security/cve/CVE-2025-32432/index.md) Craft CMS Craft CMS: Craft CMS Code Injection Vulnerability (due 2026-04-03; ransomware: Unknown)
- 2025-06-02 [CVE-2025-35939](https://erroneo.us/security/cve/CVE-2025-35939/index.md) Craft CMS Craft CMS: Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability (due 2025-06-23; ransomware: Unknown)
- 2025-06-02 [CVE-2024-56145](https://erroneo.us/security/cve/CVE-2024-56145/index.md) Craft CMS Craft CMS: Craft CMS Code Injection Vulnerability (due 2025-06-23; ransomware: Unknown)
- 2025-02-20 [CVE-2025-23209](https://erroneo.us/security/cve/CVE-2025-23209/index.md) Craft CMS Craft CMS: Craft CMS Code Injection Vulnerability (due 2025-03-13; ransomware: Unknown)

---
Source page: https://erroneo.us/security/vendor/craft-cms/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt