7.2 CVE-2026-32264
Enriched by CISA Patch
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.
https://nvd.nist.gov/vuln/detail/CVE-2026-32264
Categories
CWE-470 : Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
If the product uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the product to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the product's classpath (CWE-427) or add new entries to the product's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the product.
References
security-advisories@github.com Patch
AFFECTED (from MITRE)
| Vendor | Product | Versions |
|---|---|---|
| craftcms | cms |
|
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. | ||
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* | >= 4.0.0.1 | < 4.17.5 |
| cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* | >= 5.0.1 | < 5.9.11 |
| cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:* | ||
| cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:* | ||
| cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:* | ||
| cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:* | ||
| cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:* | ||
| cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:* | ||
REMEDIATION
Patch
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| 138 | Reflection Injection |
Very High |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
