Threat actors are actively exploiting two critical security flaws in Craft CMS to breach servers and gain unauthorized access. Orange Cyberdefense SensePost first detected these attacks on February 14, 2025, which chain together two dangerous vulnerabilities:

– **CVE-2024-58136** (CVSS 9.0): An improper protection vulnerability in the Yii PHP framework used by Craft CMS, allowing access to restricted functionality
– **CVE-2025-32432** (CVSS 10.0): A remote code execution vulnerability in Craft CMS’s image transformation feature

The second vulnerability is particularly concerning as it allows unauthenticated users to send malicious POST requests to the image transformation endpoint. “In versions 3.x, the asset ID is checked before the transformation object creation, whereas in versions 4.x and 5.x, it’s checked after,” explained security researcher Nicolas Bourras.

Attackers have been observed running multiple POST requests until discovering a valid asset ID, then executing a Python script to verify vulnerability and download malicious PHP files from GitHub repositories. Between February 10-14, 2025, the attackers refined their techniques, eventually renaming their malicious payload from “filemanager.php” to “autoload_classmap.php.”

As of April 18, approximately 13,000 vulnerable Craft CMS instances have been identified worldwide, with nearly 300 already compromised. Craft CMS advises users to check for suspicious POST requests to the “actions/assets/generate-transform” endpoint containing the string “__class” in the body, which indicates scanning activity.

If compromised, users should refresh security keys, rotate database credentials, reset passwords, and implement firewall blocks against malicious requests. The vulnerabilities have been patched in Craft CMS versions 3.9.15, 4.14.15, and 5.6.17.

In related news, an Active! Mail zero-day vulnerability (CVE-2025-42599, CVSS 9.8) is also under active exploitation, primarily targeting Japanese organizations.