CVE-2026-86732: Craft CMS before 5.10.12 Remote Code Execution via element-index
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] that reaches ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yii\rbac\PhpManager to execute code by pointing itemFile to a request log containing PHP payload in the User-Agent header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.12 - Compensating control
Since the issue affects the element-index endpoint and can be exploited via the criteria parameter by authenticated content editors, restrict access to the element-index endpoint (and/or the Craft CMS element-index route) to only required trusted users/roles at the application/auth layer.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs authenticated access with content-editor privileges. The issue is reachable through the element-index endpoint, so it is not limited to administrative accounts.
What access and conditions are required for code execution?
The attacker must be able to send a crafted criteria parameter that supplies a class through criteria[withTransforms][0][class]. The described gadget chain uses yii\rbac\PhpManager and requires pointing itemFile at a request log containing PHP payload placed in the User-Agent header.
Which versions should be treated as affected?
Craft CMS versions before 5.10.12 are affected. Upgrade to 5.10.12 or later to address the reported issue.
What can be done if an immediate upgrade is not possible?
Limit or suspend content-editor access where feasible, since authenticated content editors are the described attack prerequisite. Also restrict access to the element-index endpoint and review request-log handling, because the exploit description relies on a PHP payload recorded in the User-Agent header.
How can defenders look for exploitation attempts?
Review requests to the element-index endpoint for criteria parameters containing withTransforms and a class field, especially criteria[withTransforms][0][class]. Inspect User-Agent values and request logs for suspicious PHP payloads, and investigate attempts to use yii\rbac\PhpManager or manipulate itemFile.