CVE-2026-32264CWE-470

Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

High · published March 16, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00754 · 54.6th percentile
Weakness
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2026-03-16T19:02Z
EPSS history
Timeline
  • 16 MAR 19:02Z
    Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
    cvelistv5