What is CVE-2026-79987?

CVE-2026-79987 is a high-severity vulnerability in Craftcms Cms, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 8.8/10. Published 2026-09-10.

How severe is CVE-2026-79987?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Craftcms Cms

CVE-2026-79987

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Craftcms Cms

Weakness classification (CWE)

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)

References

7004884b-51e2-48e8-b4a2-5ca29e80453e (product)
7004884b-51e2-48e8-b4a2-5ca29e80453e (release-notes)
7004884b-51e2-48e8-b4a2-5ca29e80453e (third-party-advisory)
7004884b-51e2-48e8-b4a2-5ca29e80453e (technical-description, mitigation, third-party-advisory)

Frequently asked questions

What is CVE-2026-79987?: CVE-2026-79987 is a high-severity vulnerability in Craftcms Cms, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 8.8/10. Published 2026-09-10.
How severe is CVE-2026-79987?: High severity. CVSS v3 base score is 8.8 out of 10.