Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Published 16 Mar 2026 · Updated 2 Apr 2026
Affected packages
- Affected
- >=4.0.0-RC1 <4.17.5
- Fixed in
- 4.17.5
composer require craftcms/cms:^4.17.5- Affected
- >=5.0.0-RC1 <5.9.11
- Fixed in
- 5.9.11
composer require craftcms/cms:^5.9.11Details
The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 (commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748) only patched src/services/Fields.php, but the same vulnerable pattern exists in ElementIndexesController and FieldsController.
You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.
An attacker can use the same gadget chain from the original advisory to achieve RCE.
Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue.
Is GHSA-4484-8v2f-5748 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.
References
- Linkgithub.com/craftcms/cms/security/advisories/GHSA-4484-8v2f-5748
- Linkgithub.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-32264
- Linkgithub.com/craftcms/cms/commit/78d181e12e0b15e1300f54ec85f19859d3300f70
- Linkgithub.com/craftcms/cms/commit/dfec46362fcb40b330ce8a4d8136446e65085620
- Packagegithub.com/craftcms/cms
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.