CVE-2026-86732

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 5.10.12

Description Authenticated content editors can achieve remote code execution via the '/element-index' endpoint. The issue occurs when a malicious class is injected through the criteria parameter, specifically via criteria[withTransforms][0][class], which is then processed by the normalizeTransform() function. By utilizing a PHP gadget chain with yiirbacPhpManager, an attacker can execute arbitrary code by directing the itemFile variable to a request log that contains a PHP payload within the User-Agent header.

Recommendations Update Craft CMS to version 5.10.12 or later.