CVE-2026-32264

The record

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.

Affected packages

Related vulnerabilities

• CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in… CWE-470
• CVE-2026-112145 A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. CWE-470
• CVE-2026-78030 DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and… CWE-470
• CVE-2026-76825 RestrictedPython is a tool that helps define a subset of the Python language for… CWE-470
• CVE-2026-79987 A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp… CWE-470
• CVE-2026-41871 Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code… CWE-470
• CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')… CWE-470
• CVE-2026-58400 GeoNetwork is a catalog application to manage spatially referenced resources. CWE-470