Listen to this Post
CVE-2026-79987 is a critical remote code execution vulnerability impacting Craft CMS versions 5.9.0 through 5.10.12.
The flaw exists within the core element-search eager loading mechanism utilized by the Control Panel.
An authenticated user possessing only low-privileged access with the minimal accessCp permission can exploit this.
Unsafe handling of class selection or dynamic object construction allows input to be manipulated.
Specifically, the application improperly processes external inputs during object instantiation and query building.
This enables malicious actors to inject custom parameters into internal query execution paths.
The attacker leverages a time-based save-action oracle to infer state changes and data responses.
Because direct response output might be suppressed or invisible, the exploit relies on timing discrepancies.
By measuring the latency of HTTP requests, the attacker can systematically extract sensitive internal data.
Furthermore, the vulnerability can be chained with raw-TCP data exfiltration techniques.
This bypasses standard HTTP logging and hides data exfiltration channels from traditional web application firewalls.
The root cause stems from CWE-470, specifically the use of externally-controlled input to select classes or code.
When the Control Panel processes specific crafted requests, it instantiates arbitrary classes dynamically.
This unsafe reflection capability grants the attacker execution privileges equivalent to the PHP web worker.
Although initial authentication is required, internal accounts or compromised low-privilege users pose a severe threat.
Initial access brokers can leverage this flaw to escalate privileges within the hosting environment.
The exploit payload is wrapped inside seemingly legitimate element search queries sent to the backend.
Craft CMS deserializes or evaluates these parameters without adequate sanitization or type checking.
The time-based oracle measures execution delays introduced by conditional sleep statements in the payload.
Raw-TCP sockets are then opened to transmit stolen configuration files or environment variables out-of-band.
Security researchers, notably y3g1, developed working proof-of-concept scripts to validate this attack vector.
The tradecraft demonstrates advanced evasion characteristics designed to defeat signature-based detection mechanisms.
Standard web server logs may only show standard administrative actions while code execution occurs in the background.
Mitigating this requires immediate patching to versions above 5.10.12 or applying official GitHub advisories.
Administrators must also audit all user roles and strictly limit the accessCp permission.
Monitoring outbound network telemetry and enforcing strict egress filtering are vital defensive measures.
Without these controls, malicious actors can fully compromise the underlying host server infrastructure.
Understanding this mechanism highlights the dangers of unsafe reflection in modern content management systems.
Proper input validation and strict type constraints remain critical defenses against similar reflection flaws.
Security teams should treat any unauthorized modification of search parameters as a high-priority indicator of compromise.
DailyCVE Form:
Platform: Craft CMS
Version: 5.9.0 to 5.10.12
Vulnerability : Remote Code Execution
Severity: Critical
date: September 10 2026
Prediction: September 12 2026
(end of form)
What Undercode Say
git clone https://github.com/y3g1/CraftCMS-CVE-2026-79987 cd CraftCMS-CVE-2026-79987 python3 exploit.py --target http://target-craft.local --user lowpriv --pass password123 --cmd "id"
// Conceptual snippet showing unsafe class selection vector
$elementType = craft\helpers\RequestHelper::getParam('elementType');
$element = new $elementType();
$element->eagerLoadElements();
Exploit: (Educational Purposes!)
The exploit operates by authenticating as a standard user with `accessCp` privileges. It targets the element-search eager loading functionality where user-supplied parameters dictate class instantiation. By injecting specialized payloads that trigger time-based delays or open raw-TCP sockets, the adversary forces the PHP process to execute arbitrary system commands. The time-based oracle evaluates conditional responses character-by-character to leak sensitive environment files, while outbound raw-TCP connections exfiltrate internal configuration data directly to an attacker-controlled listener without triggering standard HTTP response logs.
Protection: from this CVE
- Upgrade Craft CMS immediately to the latest patched version resolving GHSA-fpmm-w3hp-7f39.
- Restrict the `accessCp` permission strictly to trusted administrative personnel.
- Implement strict network egress filtering and monitoring to block unauthorized outbound raw-TCP connections from web worker processes.
- Deploy endpoint detection rules to flag anomalous high-frequency database saving patterns and time-based delay signatures.
- Review and audit control panel access logs regularly for suspicious activities originating from low-privileged user accounts.
Impact
Successful exploitation allows any authenticated user with minimal control panel access privileges to achieve full remote code execution on the underlying host server. This leads to complete infrastructure compromise, unauthorized access to sensitive database credentials, environment variable theft, potential lateral movement within the internal network, and total loss of confidentiality, integrity, and availability for the deployed web application.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
