What’s Vulnerable › Vulnerabilities

CVE-2026-79987: Low-privilege RCE through element-search eager loading

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-10 · updated 2026-09-11
• Weakness: CWE-470

Description

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

Affected products

• craftcms cms: from 5.8.0 before 5.10.13 — fixed in 5.10.13

How to fix

Upgrade to a fixed version: craftcms cms 5.10.13. Check the vendor advisory for mitigations.

References

• https://github.com/craftcms/cms
• https://github.com/craftcms/cms/releases/tag/5.10.13
• https://github.com/craftcms/cms/security/advisories/GHSA-9c4j-cjw3-r3xx
• https://www.hckrt.com/hacktivity/HCKRT-9TSYY2

Get alerted when CVE-2026-79987 or the next vulnerability affects your stack