CVE-2026-79987

No fix known EPSS <1%CVSS 8.8

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

Published 2026-09-10 · CVE record · OSV

Products: craftcms cms