Code Injection in Craft CMS - CVE-2026-86732
Published: August 25, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU145007
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86732
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in ImageTransforms::normalizeTransform() when handling request-supplied transform data through the element-index endpoint. A remote user can send a specially crafted request that injects a class name and configuration to execute arbitrary code.
Exploitation requires a logged-in non-admin account with access to the control panel and view access to a volume containing at least one asset. The attack uses the admin path and requires specific request parameters for the asset query to reach the vulnerable code path.
Affected software
Craft CMS
How to mitigate CVE-2026-86732
Install security update from vendor's website.
Craft CMS - update to 5.10.12