CVE-2025-32432 in Craft CMS enables unauthenticated RCE via PHP session poisoning; root privilege escalation follows via CVE-2026-24061, a telnetd auth bypass in GNU inetutils through 2.7, CISA KEV listed. - CVE-2025-32432 (actively exploited, CISA KEV added March 2026) hits Craft CMS 5.0-5.6.16 at the unauthenticated admin/actions/assets/generate-transform endpoint. The attack abuses CVE-2024-58136 in Yii Framework: sending __class alongside class lets Yii instantiate an attacker-controlled object (GuzzleHttp\Psr7\FnStream or yii\rbac\PhpManager) while Craft's own class check passes harmlessly. The attacker first poisons a PHP session file by embedding a PHP payload in the redirect URL logged when visiting admin/dashboard with a junk parameter, then triggers execution by pointing PhpManager's itemFile at /var/lib/php/sessions/sess_[id]. Metasploit module exploit/linux/http/craftcms_preauth_rce_cve_2025_32432 automates the full chain. - Post-exploitation pivots via the Craft .env file at /var/www/html/craft/.env, which stores plaintext DB credentials (CRAFT_DB_PASSWORD). Dumping the CraftCMS users table yields a bcrypt hash crackable with hashcat mode 3200 against rockyou.txt. - Root access comes from CVE-2026-24061 (CISA KEV added January 2026): GNU inetutils telnetd through 2.7 passes the USER env variable unsanitized to login(1). #DFIR_Radar
Post summary
The post reports that CVE-2025-32432 in Craft CMS is being actively exploited via a Metasploit module, enabling RCE and privilege escalation, and that a related telnetd bypass (CVE-2026-24061) is also in use.