PT-2026-25805 · Craft Cms · Craft Cms

Angrybrad · Published 2026-02-09 · Updated 2026-03-17 · CVE-2026-32264

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.4 Craft CMS versions 5.0.0-RC1 through 5.9.10

Description Craft CMS is a content management system. A remote code execution issue exists in the ElementIndexesController and FieldsController due to a behavior injection. To exploit this, Craft control panel administrator permissions and allowAdminChanges must be enabled. An attacker can leverage the same gadget chain as a previously reported advisory to achieve remote code execution.

Recommendations Craft CMS versions 4.0.0-RC1 through 4.17.4 should be updated to version 4.17.5. Craft CMS versions 5.0.0-RC1 through 5.9.10 should be updated to version 5.9.11.

Exploit

Fix

RCE

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2026-32264

GHSA-4484-8V2F-5748

GHSA-7JX7-3846-M7W7

Affected Products

Craft Cms

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32264.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-4484-8v2f-5748 · Vendor Advisory
• https://github.com/craftcms/cms/commit/78d181e12e0b15e1300f54ec85f19859d3300f70 · Patch
• https://github.com/craftcms/cms/commit/dfec46362fcb40b330ce8a4d8136446e65085620 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32264 · Security Note
• https://osv.dev/vulnerability/GHSA-7jx7-3846-m7w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25498 · Security Note
• https://osv.dev/vulnerability/GHSA-4484-8v2f-5748 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32264 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.8.22 · Note
• https://github.com/craftcms/cms/releases/tag/4.16.18 · Note
• https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748 · Note
• https://twitter.com/CVEnew/status/2033755328425185771 · Twitter Post