CVE-2026-86732 - OSV

Osv.Dev • September 9, 2026

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] that reaches ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yii\rbac\PhpManager to execute code by pointing itemFile to a request log containing PHP payload in the User-Agent header.

Git / github.com/craftcms/cms

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Two Remote Code Execution Vulnerabilities Disclosed in Content Management Systems Two critical vulnerabilities were disclosed on September 8, 2026, affecting content management systems. CVE-2026-86732, rated 8.7 (High), impacts Craft CMS versions before 5.10.12, allowing authenticated users to execute arbitrary PHP code via the element-index endpoint. Attackers can exploit this by injecting malicious classes through specific parameters. CVE-2026-54611, rated 5.5 (Medium), affects InstantCMS versions prior to 2.18.2, enabling remote authenticated attackers to upload malicious components that can execute PHP code through custom .htaccess files. Both vulnerabilities have been patched in their respective latest versions. Users are advised to update their systems immediately to mitigate potential risks. 2 sources 57

Extracted Entities

CVE-2026-86732 - OSV

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (3)

Platforms (2)