Skip to content

Incomplete fix for GHSA-7jx7-3846-m7w7: Behavior injection RCE ElementIndexesController and FieldsController

Moderate
angrybrad published GHSA-4484-8v2f-5748 Mar 16, 2026

Package

composer craftcms/cms (Composer)

Affected versions

>= 4.0.0-RC1, <= 4.17.4
>= 5.0.0-RC1, <= 5.9.10

Patched versions

4.17.5
5.9.11

Description

The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f) only patched src/services/Fields.php, but the same vulnerable pattern exists in ElementIndexesController and FieldsController.

You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.

An attacker can use the same gadget chain from the original advisory to achieve RCE.

Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue.

References

GHSA-7jx7-3846-m7w7
dfec463
78d181e

Severity

Moderate

CVE ID

CVE-2026-32264

Weaknesses

No CWEs