CVE-2026-32264

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.4 Craft CMS versions 5.0.0-RC1 through 5.9.10

Description Craft CMS is a content management system. A remote code execution issue exists in the ElementIndexesController and FieldsController due to a behavior injection. To exploit this, Craft control panel administrator permissions and allowAdminChanges must be enabled. An attacker can leverage the same gadget chain as a previously reported advisory to achieve remote code execution.

Recommendations Craft CMS versions 4.0.0-RC1 through 4.17.4 should be updated to version 4.17.5. Craft CMS versions 5.0.0-RC1 through 5.9.10 should be updated to version 5.9.11.