PT-2026-27219 · Unknown+1 · Connect-Cms+1

Odgrso · Publicado 2026-03-23 · Atualizado 2026-03-24 · CVE-2026-32276

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Connect-CMS versions prior to 1.41.1 Connect-CMS versions prior to 2.41.1

Description Connect-CMS is a content management system. An authenticated user may be able to execute arbitrary code in the Code Study Plugin. If exploited, this could lead to code execution on the server or information disclosure.

Recommendations Update Connect-CMS to version 1.41.1 or later. Update Connect-CMS to version 2.41.1 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-32276

GHSA-HXQW-6QV7-CQFV

Produtos afetados

Code Study Plugin

Connect-Cms

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32276.json · Exploit
• https://github.com/opensource-workshop/connect-cms/commit/c0bcd07fc1e9375941aa1295d044328ecd44ed85 · Correção
• https://github.com/opensource-workshop/connect-cms · Nota
• https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1 · Nota
• https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-hxqw-6qv7-cqfv · Aviso do Fabricante
• https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32276 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2036196960491688109 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-hxqw-6qv7-cqfv · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2036208839327162391 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32276 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2036303726651027852 · Publicação no Twitter