GitHub Advisoryadvisory · Packagist
GHSA-4484-8v2f-5748 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
HIGH
Official page ↗
- Aliases
- CVE-2026-32264
- Ecosystem
- Packagist
- Packages
- craftcms/cms
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- CWE-470
- Reviewed
- 2026-03-16
Affected packages
• Packagist craftcms/cms: >= 4.0.0-RC1, < 4.17.5 → fixed in 4.17.5
• Packagist craftcms/cms: >= 5.0.0-RC1, < 5.9.11 → fixed in 5.9.11
Description
The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 (commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `ElementIndexesController` and `FieldsController`.
You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.
An attacker can use the same gadget chain from the original advisory to achieve RCE.
Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue.
Related
Alias · CVE (1)
- CVE-2026-32264 Craft CMS is a content management system (CMS). vulnerability
Weakness · CWE (1)
- CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness
References
- https://github.com/craftcms/cms/security/advisories/GHSA-4484-8v2f-5748 web
- https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-32264 advisory
- https://github.com/craftcms/cms/commit/78d181e12e0b15e1300f54ec85f19859d3300f70 web
- https://github.com/craftcms/cms/commit/dfec46362fcb40b330ce8a4d8136446e65085620 web
- https://github.com/craftcms/cms package