Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 (commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `ElementIndexesController` and `FieldsController`. You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work. An attacker can use the same gadget chain from the original advisory to achieve RCE. Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-32264US | high7.2 | — | ||
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection R… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/craftcms/cmsPACKAGE
- https://github.com/craftcms/cms/commit/78d181e12e0b15e1300f54ec85f19859d3300f70WEB
- https://github.com/craftcms/cms/commit/dfec46362fcb40b330ce8a4d8136446e65085620WEB
- https://github.com/craftcms/cms/security/advisories/GHSA-4484-8v2f-5748WEB
- https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-32264ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan