This vulnerability (CVE-2026-79987) in Craft CMS involves CWE-470, where externally-controlled input is used unsafely to select classes or code, leading to unsafe reflection. A remote attacker who is authenticated with the accessCp permission but without admin privileges can exploit this flaw to execute arbitrary operating system commands with the privileges of the PHP web worker. The vulnerability affects Craft CMS versions =5.8.0 and >=5.8.0 <5.10.13. The CVSS 4.0 score is 8.7, indicating high severity, with network attack vector, low attack complexity, no user interaction, and privileges required at the low level.

An authenticated non-admin user with accessCp permission can execute arbitrary OS commands on the server hosting Craft CMS, potentially leading to full system compromise or unauthorized control of the web server environment. This elevates the risk of data breaches, service disruption, or further attacks leveraging the compromised server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Control Panel to trusted users only and monitor for suspicious activity. Avoid granting the accessCp permission to untrusted users. Follow vendor advisories closely for updates on patches or official mitigations.