PT-2026-27219 · Opensource Workshop · Connect-Cms

Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-32276

Mitre

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an authenticated user may be able to execute arbitrary code in the Code Study Plugin. Versions 1.41.1 and 2.41.1 contain a patch.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-32276

Affected Products

Connect-Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-32276 · Security Note
• https://github.com/opensource-workshop/connect-cms/commit/c0bcd07fc1e9375941aa1295d044328ecd44ed85 · Note
• https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1 · Note
• https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1 · Note
• https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-hxqw-6qv7-cqfv · Note