6 matches found
CVE-2026-79987
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
CVE-2026-79987 Low-privilege RCE through element-search eager loading
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
CVE-2026-79987 Low-privilege RCE through element-search eager loading
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
EUVD-2026-75586
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
CVE-2026-79987
CVE-2026-79987 is a low-privilege remote code execution vulnerability in Craft CMS , exploitable by a remote, authenticated, non-admin Control Panel user holding only the accessCp permission. The root cause involves element-search eager loading , allowing the attacker to execute operating system ...
