CVE-2026-32264 in Craft
Summary
by MITRE • 03/16/2026
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/21/2026
The vulnerability CVE-2026-32264 represents a critical behavior injection remote code execution flaw affecting Craft CMS versions within specific ranges. This vulnerability exists in the ElementIndexesController and FieldsController components of the content management system, making it particularly dangerous as it targets core administrative functionality. The flaw requires specific prerequisites including administrator permissions within the Craft control panel and the explicit enabling of allowAdminChanges configuration parameter, which creates a targeted attack surface that security professionals must carefully monitor.
The technical implementation of this vulnerability stems from improper input validation and sanitization within the controller methods that handle element indexing and field management operations. When administrators interact with these components through the control panel interface, maliciously crafted input can trigger unintended behavior injection patterns that ultimately lead to arbitrary code execution on the affected server. This type of vulnerability falls under CWE-94, which specifically addresses "Improper Control of Generation of Code ('Code Injection')" and aligns with ATT&CK technique T1059.001 for command and scripting interpreter execution. The injection occurs during the processing of user-supplied data that should be properly validated and escaped before being utilized in system operations.
The operational impact of this vulnerability extends beyond simple privilege escalation as it allows attackers with administrative access to execute arbitrary commands on the web server hosting the Craft CMS installation. This capability enables full system compromise including data exfiltration, persistence mechanisms installation, and lateral movement within the network infrastructure. The vulnerability affects both major version lines of Craft CMS, creating widespread exposure across organizations that may have deployed either the 4.x or 5.x branches. Organizations running vulnerable versions face significant risk of unauthorized access and potential data breaches, particularly if they maintain administrative accounts with the allowAdminChanges feature enabled.
Mitigation strategies for CVE-2026-32264 require immediate patching of affected installations to versions 4.17.5 and 5.9.11 where the vulnerability has been resolved. Security administrators should also implement additional controls including disabling allowAdminChanges for accounts that do not require this functionality, implementing strict input validation for administrative interfaces, and monitoring for unusual administrative activities. Network segmentation and privilege separation practices should be enforced to limit potential damage from successful exploitation attempts. Organizations should conduct comprehensive vulnerability assessments to identify all instances of affected Craft CMS installations and ensure proper access controls are implemented across their administrative interfaces. The remediation process should include thorough testing of patched versions to confirm that the vulnerability has been properly addressed without introducing regressions in functionality.