EUVD-2026-72866
GHSA-j4wp-xfvq-c8f7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or compromise low-privilege control-panel account
-
DeliveryCraft malicious JSON field-layout tab payload with Yii2 behavior keys
-
ExploitPOST payload to field-layout configuration endpoint
-
ExecutionBypass string-type cleanse validation
-
PersistTrigger Craft::createObject() with attacker-controlled class configuration
-
ImpactExecute arbitrary PHP code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid Craft CMS control-panel account at any privilege level (PR:L per CVSS 4.0 vector) - editor and author roles are sufficient, with no administrator access needed. The attacker must submit field-layout tab element configurations as JSON strings to the CMS, which is a standard control-panel operation. No additional non-default configuration is required; any Craft CMS 5.x installation prior to 5.10.12 with at least one non-admin control-panel user is exploitable. Exploitation is strictly limited to users with control-panel access: unauthenticated external visitors and front-end-only API consumers cannot trigger this vulnerability. |
| Impact | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N) reflects a high-severity flaw with a low but present barrier: any authenticated control-panel user can trigger it without admin privileges. In organizations running Craft CMS with multiple editor or author accounts, the attack surface is meaningfully broad, and any deployment with non-admin content editors should treat this as an urgent patch priority. No public exploit code exists at time of analysis and the vulnerability is not in CISA KEV, moderately tempering immediate urgency, but the straightforward exploitation mechanism - a crafted JSON POST to a standard CMS endpoint - means weaponization risk is non-trivial once the advisory is widely circulated. EPSS data is not included in the provided intelligence, so probability-of-exploitation quantification is not possible from available inputs. |
| Exploit ScenarioDerived | An attacker who has obtained or compromised a low-privilege Craft CMS control-panel account - such as a content editor or author - crafts a JSON payload embedding Yii2 behavior class definitions and submits it as a field-layout tab element configuration via a standard CMS endpoint. The payload bypasses the string-type cleanse validation and is passed to Craft::createObject(), which instantiates an attacker-chosen PHP class, yielding arbitrary server-side code execution under the web server process. No confirmed public exploit code exists at time of analysis, but the attack primitive closely follows documented Yii2 behavior-injection patterns available in public framework security research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.
RemediationAI
Upgrade Craft CMS to version 5.10.12 or later immediately, as documented in GitHub Security Advisory GHSA-qj4v-m29p-fj4m at https://github.com/craftcms/cms/security/advisories/GHSA-qj4v-m29p-fj4m. If an immediate upgrade is not feasible, restrict control-panel access to the minimum necessary user accounts and audit all existing accounts for unauthorized or excessive privilege assignments, since any panel user at any role level can exploit this flaw. Blocking unauthenticated or untrusted access to the control-panel route via web-server ACL or IP allowlisting reduces the exposed attack surface but does not protect against exploitation by legitimate compromised accounts. Temporary suspension of non-essential editor accounts is a viable compensating control, with the trade-off of reducing content-management capacity during the remediation window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Craft CMS (CPE: cpe:2.3:a:craftcms:cms) is built on the Yii2 PHP framework. Yii2 supports 'behaviors' - dynamically attachable components that augment class functionality at runtime - as well as configurable event handlers. The Craft::createObject() factory method, inherited from Yii2, can instantiate arbitrary classes from configuration arrays specifying 'class', 'behaviors', and event handler keys. CWE-94 (Improper Control of Generation of Code / Code Injection) accurately describes the root cause: the application fails to sanitize string-typed field-layout tab element data before passing it into this factory, allowing attacker-supplied JSON to act as a class-instantiation configuration. The bypass specifically exploits the fact that the cleanse logic does not handle string-typed elements the same way it handles other field-layout element types.
Know when Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-accessible control panel, low-complexity exploit, any authenticated panel user (PR:L), no user interaction; arbitrary code execution yields full C/I/A impact within the application scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
Technical POC Analysis
The bug is an incomplete cleanse-bypass in Craft CMS field-layout hydration, matching CWE-94 (code injection).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Craft CMS versions before 5.10.12 allow any authenticated control-panel user to execute arbitrary code through manipulated field-layout submissions, creating a critical insider-threat vector with no public exploit identified at time of analysis. Organizations with multiple editor, author, or administrator accounts face significant risk of data compromise, malware injection, and system takeover if any control-panel credential is compromised or misused.
Until a patched version is released: restrict control-panel access to a minimal set of highly-trusted administrators with strict IP whitelisting; implement real-time alerting on field-layout changes and JSON submissions containing suspicious patterns (e.g., object-instantiation syntax); enforce multi-factor authentication on all control-panel accounts; review and disable any inactive or test user accounts; conduct weekly audits of control-panel access logs for anomalous activity; and isolate the Craft CMS server network segment from sensitive systems to limit lateral movement in case of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
Unauthenticated file disclosure in LavaLite CMS through 10.1.2 allows remote attackers to download private stored files
Authenticated remote code execution in Craft CMS versions 5.5.0 through 5.9.13 allows admin users to execute arbitrary P
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Exploit-DB