Craft Cms Before 5.10.12 Remote Code Execution Via Element Index

Back www.vulncheck.com

Craft Cms Before 5.10.12 Remote Code Execution Via Element Index

www.vulncheck.com • September 9, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerabilities in Craft CMS Versions Before 5.10.12 Two critical remote code execution (RCE) vulnerabilities have been identified in Craft CMS versions before 5.10.12. The first vulnerability, linked to behavior injection, affects Craft CMS 5.0.0 RC1 and earlier versions. The second vulnerability allows RCE via the element index, impacting all versions prior to 5.10.12. These vulnerabilities could allow attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. Administrators are urged to prioritize patching these vulnerabilities due to their severity. Current status indicates that both vulnerabilities are disclosed but not yet confirmed to be actively exploited in the wild. No specific CVEs were mentioned in the articles. Organizations using Craft CMS are advised to update to version 5.10.12 or later to mitigate these risks. 2 sources 71

Extracted Entities

Attack Types (1)

Zero-day Exploit

MITRE ATT&CK (1)

T1203 - Exploitation for Client Execution

Platforms (1)

Vulnerabilities (1)

Element Index Vulnerability