EUVD-2026-104580
GHSA-9m6c-jxf8-fjvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Craft admin (allowAdminChanges on)
-
DeliverySubmit malicious JSON field layout to ContentBlock::setFieldLayout()
-
ExploitInject Yii 'as'/'on' behavior bypassing cleanseConfig()
-
ExecutionExecute OS commands as web user
-
ImpactDisclose secrets and achieve RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Craft CMS administrator account AND the 'allowAdminChanges' configuration setting enabled (typically used only in development/staging, not production), plus the ability to supply a JSON-string field layout to ContentBlock::setFieldLayout() containing Yii 'as X' or 'on X' keys that evade cleanseConfig(). Limiting factors: this is not reachable by unauthenticated or non-admin users, and production instances with allowAdminChanges disabled (the recommended default) are not exploitable, substantially narrowing the realistic attack surface despite the network vector. |
| Impact | This is a genuine but conditionally-gated risk rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) rates it 8.7 (High), reflecting full confidentiality/integrity/availability impact over the network with low attack complexity. However, the critical mitigating signal is in the description, not the vector: exploitation requires an authenticated administrator AND the 'allowAdminChanges' setting to be enabled, which is typically a development/staging configuration and disabled in production. I assess the vendor's PR:L as optimistic - administrator-level access is a high privilege, so PR:H is more defensible, which lowers the realistic base score. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit is referenced, so there is no evidence of active exploitation or weaponization. In short: a high-impact RCE whose real-world risk is substantially constrained by the dual precondition of admin credentials plus a non-default config flag. Prioritize patching for any internet-facing Craft instance that may run with allowAdminChanges enabled, but this is not a mass-exploitation-class issue on default production deployments. |
| Exploit ScenarioDerived | An attacker who has obtained (or abused) a Craft CMS administrator account on an instance running with allowAdminChanges enabled submits a crafted JSON field-layout string to ContentBlock::setFieldLayout() containing Yii 'as X' or 'on X' keys. Because these keys bypass cleanseConfig(), the injected Yii behavior executes operating-system commands as the web server user and can disclose application secrets. No public exploit code is referenced at time of analysis, so a working attack would currently require the attacker to develop it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Authenticated administrator accounts on Craft CMS 5.8.0 through 5.10.x can achieve remote code execution by submitting a crafted JSON-string field layout to ContentBlock::setFieldLayout() that embeds Yii 'as X' or 'on X' configuration keys, which slip past the platform's cleanseConfig() sanitization and let an attacker attach arbitrary behavior classes and event handlers that run OS commands as the web user and expose stored secrets. Exploitation is gated on the allowAdminChanges setting being enabled and on the attacker already holding admin control-panel access, so hardened production installs with that setting disabled (the recommended posture) are not reachable and the realistic attack surface is materially narrower than the 8.7 score suggests; no public exploit has been identified at time of analysis and no CISA KEV entry exists.
RemediationAI
Vendor-released patch: upgrade Craft CMS to 5.11.0 or later, which is the exact fixed version named in the advisory. Until the upgrade can be applied, disable allowAdminChanges in config/general.php on every production and internet-facing instance - this closes the precondition for exploitation, but the trade-off is that project config can no longer be written from the control panel and must instead be applied via the CLI (project-config/apply) or deployments. Additionally, restrict access to the admin control panel by IP allowlist or front-end proxy auth and reduce the number of admin accounts, since a valid administrator session is required before the malicious field layout can be submitted; audit stored field layout JSON for 'as' or 'on' keys and inspect web server and Craft logs for unexpected PHP child processes or outbound connections from the web user. Because the payload executes arbitrary OS commands as the web user, treat any instance that had allowAdminChanges enabled and untrusted admin access as potentially compromised: rotate secrets in .env and the database, review the security key, and compare the codebase and project config against a known-good baseline. Full details and any vendor guidance on the cleanseConfig() hardening are in GHSA-j6r9-fxgv-j7x5.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Craft CMS is built on the Yii 2 PHP framework, whose configuration arrays support two special shorthand keys: 'as X' attaches a behavior object to a component and 'on X' binds an event handler. Because behaviors and handlers are instantiated by the framework from the supplied configuration, allowing untrusted input to reach those keys is effectively arbitrary class instantiation and method invocation - the classic code-injection pattern captured by CWE-94 (Improper Control of Generation of Code). This CVE concerns the ContentBlock element's field-layout setter: when a field layout is supplied as a JSON string, Craft's cleanseConfig() routine is intended to strip dangerous keys before Yii processes the configuration, but the 5.8.0-5.10.x implementation fails to catch 'as'/'on' entries, so a crafted layout is deserialized into a live Yii component configuration. The result is attacker-controlled PHP execution in the context of the web server user, with follow-on read access to configuration and environment secrets. The CPE cpe:2.3:a:craftcms:cms identifies the affected package as the core Craft CMS distribution rather than a plugin. The condition that makes this reachable - allowAdminChanges enabled - is a project-config write toggle normally reserved for development and staging workflows, which is why the authoritative assessment scores it PR:H even though the upstream CVSS 4.0 vector rates PR:L; both agree on network vector, low attack complexity, and high confidentiality, integrity, and availability impact (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Know when Craft Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable admin panel with low complexity, but requires an administrator account plus allowAdminChanges, so PR:H; code execution as web user yields full C/I/A with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
Technical POC Analysis
CWE-94 (Improper Control of Generation of Code / Code Injection) - an object-config to behavior-injection flaw in Craft CMS core.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Craft CMS 5.8.0 through 5.10.x exposes a high-severity flaw that lets an already-privileged control-panel administrator escalate from content administration to operating-system command execution and access to stored secrets - but only where the allowAdminChanges setting has been left enabled. The practical exposure therefore concentrates in organizations that grant broad or standing admin rights and that run production instances without hardened configuration baselines, rather than across the whole CMS estate. Leadership should care because no vendor patch is currently identified, meaning configuration discipline and admin-account governance are the only brakes on a path from one over-privileged or phished admin account to server-level compromise and credential theft.
No vendor patch identified; set allowAdminChanges to false on all production instances (the primary mitigation and the gate for exploitation), restrict control-panel access via SSO, MFA and network allowlists, minimize standing administrator accounts and audit them regularly, log and alert on field-layout and configuration changes, restrict the web-server user's outbound access and command execution, and migrate secrets reachable by that user into a secrets manager.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Craft CMS versions 3.x through 5.x contain a critical remote code execution vulnerability (CVSS 10.0) that allows unauth
Craft CMS stores arbitrary content provided by unauthenticated users in session files. Rated medium severity (CVSS 6.9),
Craft CMS is a platform for creating digital experiences. Rated critical severity (CVSS 9.8), this vulnerability is remo
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Rated critical sev
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. Rated crit
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed
RCE in Craft CMS before 4.17.0-beta.1/5.9.0-beta.1 via template injection for authenticated admins. PoC and patch availa
Authenticated remote code execution in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 lets an
SQL injection in Craft CMS 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 allows authenticated Control Panel use
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Sectio
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the a
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and
Exploit-DB