CVE-2026-79987

Craft CMS contains a vulnerability (CWE-470, unsafe reflection) that allows a remote, authenticated, non-admin Control Panel user holding only the accessCp permission to execute operating system commands. Triggering the flaw requires nothing more than network access to the Control Panel and a low-privilege login, with no user interaction needed. Successful exploitation yields command execution as the PHP web worker on the web server, with high impact on the confidentiality, integrity, and availability of the local application, and potentially a foothold for lateral movement depending on the worker's privileges. All Craft CMS deployments that grant Control Panel access to non-administrator accounts are affected, while sites whose CP users are all admins are not exposed via this path. No public proof-of-concept, KEV listing, or known in-the-wild exploitation exists at this time.

What to do: Upgrade Craft CMS to the latest patched release per the vendor advisory, as the source data does not specify fixed version numbers. In the meantime, audit Control Panel accounts and remove or restrict non-admin users who hold only the accessCp permission, and monitor for unexpected child processes spawned by the PHP web worker.