CVE-2026-79987 Low-privilege RCE through element-search eager loading

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-79987

CVE-2026-79987 is a low-privilege remote code execution vulnerability in Craft CMS , exploitable by a remote, authenticated, non-admin Control Panel user holding only the accessCp permission. The root cause involves element-search eager loading , allowing the attacker to execute operating system ...