Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-86732Craft CMS before 5.10.12 Remote Code Execution via element-index

High 8.8

In plain English

A high-severity code injection in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.9%top 41.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] that reaches ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yii\rbac\PhpManager to execute code by pointing itemFile to a request log containing PHP payload in the User-Agent header.

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	5.0.0-RC1 – before 5.10.12

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-9wcj-wqqh-cqvg) vendor-advisory
VulnCheck Advisory: Craft CMS before 5.10.12 Remote Code Execution via element-index third-party-advisory