Vulnerability · Published Mar 23, 2026 · Assigned by GitHub_M
CVE-2026-32276Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
High 8.8
In plain English
A high-severity code injection in connect-cms from opensource-workshop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 59.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an authenticated user may be able to execute arbitrary code in the Code Study Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | opensource-workshop/connect-cms | 1.41.1 | GHSA-hxqw-6qv7-cqfv |
| Packagist | opensource-workshop/connect-cms | 2.41.1 | GHSA-hxqw-6qv7-cqfv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| opensource-workshop | connect-cms | < 1.41.1>= 2.0.0, < 2.41.1 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-hxqw-6qv7-cqfv x_refsource_CONFIRM
- https://github.com/opensource-workshop/connect-cms/commit/c0bcd07fc1e9375941aa1295d044328ecd44ed85 x_refsource_MISC
- https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1 x_refsource_MISC
- https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1 x_refsource_MISC