CVE-2026-86732

Craft CMS versions before 5.10.12 contain a remote code execution flaw in the element-index endpoint that lets authenticated content editors make the application instantiate arbitrary PHP classes through the criteria parameter. An attacker injects a class name via criteria[withTransforms][0][class], which reaches ImageTransforms::normalizeTransform(), and then chains the yii\rbac\PhpManager gadget by pointing itemFile at a request log containing attacker-supplied PHP in the User-Agent header to execute code. Successful exploitation yields full code execution on the web server, with high impact on the confidentiality, integrity, and availability of the CMS instance and its data. All Craft CMS deployments running versions before 5.10.12 are affected, though exploitation requires valid low-privilege content-editor credentials, so risk concentrates on sites with untrusted or compromised editor accounts. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.5% probability of exploitation in the next 30 days, indicating no observed in-the-wild exploitation so far.

What to do: Upgrade Craft CMS to version 5.10.12 or later as soon as possible. Until upgraded, limit content-editor accounts to fully trusted users and review web request logs for POSTs to the element-index endpoint carrying criteria[withTransforms][0][class] values or PHP-looking payloads in the User-Agent header. Also confirm whether the yii\rbac\PhpManager itemFile path or request logs in your configuration are writable in ways an attacker could influence.