CVE-2026-112774 in Craft CMS
الملخص
بحسب MITRE • 19/10/2026
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.