Threats Tagged 'ghsa-fpmm-w3hp-7f39'

CVE-2026-79987 is a high-severity vulnerability in Craft CMS that allows a remote, authenticated user with only the accessCp permission (non-admin) to execute operating system commands as the PHP web worker. This issue arises from unsafe reflection due to externally controlled input used to select classes or code. The vulnerability affects Craft CMS versions from 5.8.0 up to but not including 5.10.13.