PT-2026-25805 · Craft Cms · Craft Cms

Angrybrad · Publicado 2026-02-09 · Atualizado 2026-03-17 · CVE-2026-32264

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.4 Craft CMS versions 5.0.0-RC1 through 5.9.10

Description Craft CMS is a content management system. A remote code execution issue exists in the ElementIndexesController and FieldsController due to a behavior injection. To exploit this, Craft control panel administrator permissions and allowAdminChanges must be enabled. An attacker can leverage the same gadget chain as a previously reported advisory to achieve remote code execution.

Recommendations Craft CMS versions 4.0.0-RC1 through 4.17.4 should be updated to version 4.17.5. Craft CMS versions 5.0.0-RC1 through 5.9.10 should be updated to version 5.9.11.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-470

Identificadores relacionados

CVE-2026-32264

GHSA-4484-8V2F-5748

GHSA-7JX7-3846-M7W7

Produtos afetados

Craft Cms

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32264.json · Exploit
• https://github.com/craftcms/cms · Nota
• https://github.com/craftcms/cms/commit/dfec46362fcb40b330ce8a4d8136446e65085620 · Correção
• https://github.com/craftcms/cms/security/advisories/GHSA-4484-8v2f-5748 · Aviso do Fabricante
• https://github.com/craftcms/cms/commit/78d181e12e0b15e1300f54ec85f19859d3300f70 · Correção
• https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7 · Aviso do Fabricante
• https://github.com/craftcms/cms/releases/tag/5.8.22 · Nota
• https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748 · Nota
• https://github.com/craftcms/cms/releases/tag/4.16.18 · Nota
• https://twitter.com/VulmonFeeds/status/2033761268016837065 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033755328425185771 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25498 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-32264 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32264 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7jx7-3846-m7w7 · Aviso do Fabricante