CVE-2026-86732: Improper Control of Generation of Code ('Code Injection') in craftcms cms

CVE-2026-86732 is a remote code execution vulnerability in Craft CMS prior to version 5.10.12. The flaw exists in the element-index endpoint, where authenticated content editors can instantiate arbitrary classes through the criteria parameter. Specifically, attackers can inject a malicious class via criteria[withTransforms][0][class], which is processed by ImageTransforms::normalizeTransform(). This enables a PHP gadget chain using yii\rbac\PhpManager to execute arbitrary code by pointing itemFile to a request log containing a PHP payload embedded in the User-Agent header.

Successful exploitation of this vulnerability allows authenticated content editors to execute arbitrary PHP code on the server, potentially leading to full system compromise. The vulnerability requires authentication with content editor privileges but does not require user interaction. The CVSS 4.0 score of 8.7 indicates high severity with network attack vector, low attack complexity, and no user interaction required.

A fix is available in Craft CMS version 5.10.12. Users should upgrade to version 5.10.12 or later to remediate this vulnerability. No additional mitigations are specified. Patch status is confirmed by the version range indicating affected versions are prior to 5.10.12.