CVE-2026-86732: Craft CMS RCE Vulnerability

CVE-2026-86732 Overview

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint. Authenticated content editors can instantiate arbitrary PHP classes through the criteria parameter. The flaw resides in how the endpoint processes the criteria[withTransforms][0][class] value, which reaches ImageTransforms::normalizeTransform() without proper class validation. Attackers chain this class instantiation with a PHP object gadget in yii\rbac\PhpManager to achieve code execution. The gadget reads an attacker-controlled request log by pointing itemFile at it, then executes a PHP payload previously injected via the HTTP User-Agent header. This categorizes as a code injection weakness [CWE-94].

Critical Impact
Authenticated content editors can execute arbitrary PHP on the Craft CMS host, resulting in full application and server compromise.

Affected Products

Craft CMS versions before 5.10.12
Deployments exposing the element-index controller endpoint
Instances with request logging that reflects the User-Agent header to disk

Discovery Timeline

2026-09-08 - CVE-2026-86732 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86732

Vulnerability Analysis

The vulnerability exists in the Craft CMS element-index controller, which accepts a user-supplied criteria array during element listing operations. The framework passes nested values from criteria[withTransforms] into ImageTransforms::normalizeTransform(). That method instantiates the class specified in the class key without restricting it to an allowlist of transform types. This behavior turns a benign query parameter into an arbitrary object construction primitive available to any authenticated content editor.

Once arbitrary class instantiation is available, an attacker selects yii\rbac\PhpManager from the bundled Yii framework as a gadget. PhpManager includes an itemFile property that is later read and evaluated as a PHP file during object initialization. Pointing itemFile at a web server or application request log turns log poisoning into code execution. The attacker seeds the log by sending a request whose User-Agent header carries a valid PHP payload, then triggers the deserialization path via the crafted criteria payload.

Root Cause

The root cause is unrestricted class instantiation from user input inside ImageTransforms::normalizeTransform(). The method trusts the class key of a caller-supplied array instead of enforcing an allowlist of transform classes. Combined with a reachable PHP gadget in a bundled dependency, this design flaw converts a low-privilege editor session into remote code execution.

Attack Vector

Exploitation requires network access to the Craft CMS admin surface and valid credentials for a content editor account. The attacker first issues an HTTP request containing PHP code inside the User-Agent header to place the payload into a predictable log file. The attacker then calls the element-index endpoint with a criteria[withTransforms][0][class] value set to yii\rbac\PhpManager and additional keys that set itemFile to the log path. Craft CMS instantiates the gadget, reads the poisoned log, and executes the embedded PHP under the web server user.

Proof-of-concept exploitation details are documented in the VulnCheck Advisory on RCE and the GitHub Security Advisory.

Detection Methods for CVE-2026-86732

Indicators of Compromise

HTTP requests to element-index containing criteria[withTransforms] parameters with a class key referencing yii\rbac\PhpManager or other non-transform classes.
User-Agent header values containing PHP tokens such as <?php, eval(, system(, or base64_decode(.
Unexpected PHP processes spawned by the web server user shortly after element-index requests.
New or modified files in web-writable directories following editor login activity.

Detection Strategies

Inspect application and reverse proxy logs for element-index requests whose query string includes withTransforms combined with a class parameter.
Alert on User-Agent strings that contain PHP syntax or shell metacharacters, since legitimate clients do not send such values.
Correlate authenticated editor sessions with subsequent outbound network connections from the PHP-FPM or web server process.

Monitoring Recommendations

Enable verbose logging on the Craft CMS controller layer and forward logs to a centralized analytics platform for retention and search.
Baseline normal criteria parameter usage from trusted editors, then alert on deviations that introduce object instantiation keys.
Monitor for changes to log files that are subsequently read by the PHP interpreter, which is atypical outside of exploitation.

How to Mitigate CVE-2026-86732

Immediate Actions Required

Upgrade Craft CMS to version 5.10.12 or later on all environments, prioritizing internet-facing installations.
Rotate credentials for all content editor and administrator accounts after patching to invalidate any sessions obtained during exposure.
Review recent element-index request logs for the indicators listed above and initiate incident response if matches are found.
Audit web-writable directories and log locations for unexpected PHP files or modifications.

Patch Information

Craft CMS has released version 5.10.12, which restricts class instantiation inside ImageTransforms::normalizeTransform() to expected transform types. Administrators should follow the upgrade guidance in the GitHub Security Advisory and validate the update in staging before promoting to production.

Workarounds

Restrict access to the Craft CMS control panel with network-level controls such as IP allowlisting or a VPN until patching completes.
Enforce strong authentication and reduce the number of accounts granted content editor privileges.
Configure the web server to strip or normalize suspicious User-Agent values before they are written to log files that PHP can read.
Relocate request logs outside of paths readable by the PHP process where feasible.