CVE-2026-32264

March 17, 2026, 5:53 p.m.

8.6
High

Description

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.

Product(s) Impacted

Vendor Product Versions
Craftcms
  • Craft Cms
  • *, 4.0.0, 5.0.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a craftcms craft_cms / / / / / / / /
a craftcms craft_cms / / / / / / / /
a craftcms craft_cms 4.0.0 - / / / / / /
a craftcms craft_cms 4.0.0 rc1 / / / / / /
a craftcms craft_cms 4.0.0 rc2 / / / / / /
a craftcms craft_cms 4.0.0 rc3 / / / / / /
a craftcms craft_cms 5.0.0 - / / / / / /
a craftcms craft_cms 5.0.0 rc1 / / / / / /

References

https://github.com/craftcms/cms/commit/78d181e12e0b15e1300f54ec85f19859d3300f70
https://github.com/craftcms/cms/commit/dfec46362fcb40b330ce8a4d8136446e65085620
https://github.com/craftcms/cms/security/advisories/GHSA-4484-8v2f-5748
https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7

Tags

[email protected]
CWE-470
2026-03-16
CVE-2026-32264

CVSS Score

8.6 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: HIGH
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: March 16, 2026, 8:16 p.m.
Last Modified: March 17, 2026, 5:53 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.