CVE-2026-32264: Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.
Other sources
The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 (commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748) only patched src/services/Fields.php, but the same vulnerable pattern exists in ElementIndexesController and FieldsController.
You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.
An attacker can use the same gadget chain from the original advisory to achieve RCE.
Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32264?
CVE-2026-32264 has been classified as a critical remote code execution vulnerability.
How do I fix CVE-2026-32264?
To fix CVE-2026-32264, upgrade Craft CMS to version 4.17.5 or version 5.9.11.
What versions of Craft CMS are affected by CVE-2026-32264?
Craft CMS versions from 4.0.0-RC1 to before 4.17.5 and from 5.0.0-RC1 to before 5.9.11 are affected by CVE-2026-32264.
What type of vulnerability is CVE-2026-32264?
CVE-2026-32264 is a behavior injection remote code execution (RCE) vulnerability.
Is there a known exploit for CVE-2026-32264?
Yes, there is a potential for exploitation due to the nature of the remote code execution vulnerability in CVE-2026-32264.