Craft CMS is a content management system. From version 4.0.0-RC1 to before 4.17.5 and from version 5.0.0-RC1 to before 5.9.11, a behavior injection remote code execution vulnerability exists in the ElementIndexesController and FieldsController. When an authenticated control panel administrator with the allowAdminChanges setting enabled submits a crafted request, arbitrary PHP code can be injected and executed on the server, leading to remote code execution. This is a CWE-470 type weakness – the use of a dangerous function allows untrusted code execution.

Affected systems are all installations of Craft CMS (craftcms:cms). The vulnerability applies to all releases from 4.0.0-RC1 through 4.17.4 inclusive and from 5.0.0-RC1 through 5.9.10 inclusive. The corresponding CPE entries indicate that versions 4.0.0 to 4.17.4 and 5.0.0 to 5.9.10 are affected.

The CVSS base score of 8.6 indicates a high severity issue, and although the EPSS score is reported as less than 1%, the vulnerability remains a serious risk because it requires only a privileged account with the allowAdminChanges setting. The flaw is not currently listed in the CISA KEV catalog, but if exploited it would allow an attacker to gain full control over the web application server. Given the severity rating and the ease of exploitation for an authenticated admin, the recommendation is to patch immediately.