CVE-2026-32264
1 advisory.
Packagist/craftcms/cms CVE-2026-32264: high
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Action: Upgrade craftcms/cms to 4.17.5 or later.
composer require craftcms/cms:4.17.5composer require craftcms/cms:5.9.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0-RC1 | 4.17.5 | - |
| 5.0.0-RC1 | 5.9.11 | - |
Fixed versions
| 4.17.5 | 5.9.11 |
Sources
- osv: GHSA-4484-8v2f-5748
- https://github.com/craftcms/cms/security/advisories/GHSA-4484-8v2f-5748
- https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7
- https://nvd.nist.gov/vuln/detail/CVE-2026-32264
- https://github.com/craftcms/cms/commit/78d181e12e0b15e1300f54ec85f19859d3300f70
- https://github.com/craftcms/cms/commit/dfec46362fcb40b330ce8a4d8136446e65085620
- https://github.com/craftcms/cms
CVE-2026-32264 · published · modified · JSON