Patchfirst
Patchfirst
ChainCraft CMSPackagist:craftcms/cms

Craft CMS: incomplete fixes (2023–2025)

3 CVEs over 2 generations, 13 Sep 2023 to 25 Apr 2025. 2 are in .

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2023-4189213 Sep 2023 First in the chain
  2. CVE-2024-5614518 Dec 2024KEV No direct link to an earlier CVE
  3. CVE-2025-3243225 Apr 2025KEV incomplete fix for CVE-2023-41892next fix after CVE-2024-56145
Sep 2023Apr 2024OctApr 2025 CVE-2023-41892 → CVE-2025-32432: incomplete fix (high confidence)CVE-2024-56145 → CVE-2025-32432: Next fix in the same package (medium confidence) CVE-2023-41892 13 Sep 2023 CVE-2024-56145 18 Dec 2024 CVE-2025-32432 25 Apr 2025 Sep 2023Jan 2024OctJan 2025Apr CVE-2023-41892 → CVE-2025-32432: incomplete fix (high confidence)CVE-2024-56145 → CVE-2025-32432: Next fix in the same package (medium confidence) CVE-2023-41892 13 Sep 2023 CVE-2024-56145 18 Dec 2024 CVE-2025-32432 25 Apr 2025
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2023-41892 13 Sep 2023 Craft CMS Remote Code Execution vulnerability · fixed in 4.4.15 First in chain 67.0
CVE-2024-56145KEV 18 Dec 2024 Craft CMS Code Injection Vulnerability · fixed in 5.5.2 First in chain 69.8
CVE-2025-32432KEV 25 Apr 2025 Craft CMS Code Injection Vulnerability · fixed in 5.6.17 CVE-2023-41892 · incomplete fix · High 70.0
↑ ↓ chooseEnter openEsc close