ExploitPublished
Craft CMS 5.6.16 · RCE
Source Exploit-DB RSS Feed
0
Severity
CriticalRated by Threat Radar
Data as of 5 May 2026, 07:48 UTC
What to do
AI-suggested
Until an official fix is released, users should monitor vendor communications and consider applying any recommended temporary mitigations once available.
Description
Craft CMS 5.6.16 - RCE
Indicators of compromise
Exploit source code
# Exploit Title: Craft CMS 5.6.16 - RCE
# Google Dork: N/A
# Date: 2026-01-24
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Vendor Homepage: https://craftcms.com
# Software Link: https://github.com/craftcms/cms
# Version: <= 3.9.14, <= 4.14.14, <= 5.6.16
# Tested on: Linux, Apache/Nginx, PHP 8.x
# CVE: CVE-2025-32432
#
# Description:
# Craft CMS contains a pre-authentication remote code execution vulnerability
# in the assets/generate-transform endpoint. By abusing a Yii …References
Community reviews
Loading reviews…