Skip to main content

Craft Cms CVE-2026-25498

HIGH
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)
2026-02-09 security-advisories@github.com GHSA-7jx7-3846-m7w7
PHP RCE Craft Cms Craftcms
7.2
CVSS 3.1 · GitHub Advisory
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate as administrator
  2. Delivery
    Access field configuration interface
  3. Exploit
    Inject malicious Yii2 behavior config
  4. Execution
    assembleLayoutFromPost() parses unsanitized data
  5. Persist
    Craft::createObject() instantiates injected behavior
  6. Impact
    Execute arbitrary system commands

Vulnerability Assessment

Weakness
CWE
CWE-470
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V15 - Secure Coding and Architecture Reflection safety, class allowlisting
Exploitation Conditions

Authenticated administrator account required. Craft CMS versions 4.0.0-RC1 through 4.16.17 or 5.0.0-RC1 through 5.8.21. Access to field configuration feature in admin panel. Yii2 behavior injection must be supported by target installation.
Impact

CVSS 7.2 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: High. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. Public exploit/POC available.
Exploit ScenarioDerived

A remote attacker (requires authentication) could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Craft is a platform for creating digital experiences. [CVSS 7.2 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 5.8.22.. Restrict network access to the affected service where possible.

Affected Packages

composer craftcms/cms fix: 4.16.18, 5.8.22

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in composer

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Affects Craft Cms. Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This

Know when Craft Cms gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
PoC Detected
Feb 19, 2026 - 19:20 vuln.today
Public exploit code
Patch released
Feb 19, 2026 - 19:20 nvd
Patch available
CVE Published
Feb 09, 2026 - 20:15 nvd
HIGH 7.2

DescriptionGitHub Advisory

Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22.

Executive ViewAI

Why It Matters

A HIGH severity vulnerability (CVE-2026-25498) affects Craft platform deployments with a 7.2 CVSS score. Organizations running Craft for content management or digital experience delivery face potential compromise; immediate patching is required given the availability of public exploits.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 53% exploitable
Exploit
POC
Public exploit code exists
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

56
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*

More in Craft Cms

View all
CVE-2025-32432 CRITICAL POC
10.0 Apr 25

Craft CMS versions 3.x through 5.x contain a critical remote code execution vulnerability (CVSS 10.0) that allows unauth
CVE-2025-35939 MEDIUM
6.9 May 07

Craft CMS stores arbitrary content provided by unauthenticated users in session files. Rated medium severity (CVSS 6.9),
CVE-2023-41892 CRITICAL POC
9.8 Sep 13

Craft CMS is a platform for creating digital experiences. Rated critical severity (CVSS 9.8), this vulnerability is remo
CVE-2024-56145 CRITICAL POC
9.3 Dec 18

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Rated critical sev
CVE-2024-37843 CRITICAL POC
9.8 Jun 25

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. Rated crit
CVE-2020-9757 CRITICAL POC
9.8 Mar 04

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed

CVE-2026-28697 CRITICAL POC
9.1 Mar 04

RCE in Craft CMS before 4.17.0-beta.1/5.9.0-beta.1 via template injection for authenticated admins. PoC and patch availa
CVE-2025-68455 HIGH POC
8.6 Jan 05

Authenticated remote code execution in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 lets an
CVE-2026-25495 HIGH POC
8.8 Feb 09

SQL injection in Craft CMS 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 allows authenticated Control Panel use
CVE-2023-30130 HIGH POC
8.8 May 12

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Sectio
CVE-2022-29933 HIGH POC
8.8 May 09

Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the a
CVE-2018-3814 HIGH POC
8.8 Jan 01

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and

Same weakness CWE-470 – Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

View all
CVE-2026-82078 CRITICAL POC
9.4
CVE-2025-53693 CRITICAL POC
9.8
CVE-2024-0200 CRITICAL POC
9.8
CVE-2024-4990 CRITICAL POC
9.1
CVE-2026-61599 HIGH POC
8.8
CVE-2026-65608 HIGH POC
8.7
CVE-2024-28121 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

References

Advisories & patches
PATCH https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748 REF https://github.com/craftcms/cms/releases/tag/5.8.22

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy