Command Injection Vulnerability in Craft CMS Affects Non-Admin Users
CVE-2026-79987

8.7HIGH

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
10 September 2026

What is CVE-2026-79987?

An authenticated user with limited access in Craft CMS can exploit a security flaw, leading to the execution of operating system commands through the PHP web worker. This vulnerability may allow unauthorized actions within the server environment, posing significant risks to application integrity and data security.

Affected Version(s)

cms 5.8.0 < 5.10.13

References

https://www.hckrt.com/hacktivity/HCKRT-9TSYY2
third-party-advisorytechnical-descriptionmitigation
https://github.com/craftcms/cms/releases/tag/5.10.13
release-notes
https://github.com/craftcms/cms
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

@CryptoCat
Hackrate
.