CVE-2026-112773 in Craft CMS
Summary
by MITRE • 10/19/2026
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
Craft CMS versions prior to 5.11.0 contain a critical remote code execution vulnerability affecting authenticated Control Panel users. This flaw stems from improper input validation within specific element query methods, namely getNext, getPrev, and getOwners. While these functions are designed to retrieve related elements based on provided criteria, they fail to adequately sanitize user-supplied data before passing it into the underlying Yii framework's configuration handling mechanisms. An attacker with valid authentication credentials can exploit this lack of sanitization by injecting specially crafted input that targets internal object properties or event handlers rather than standard query parameters.
The technical core of the vulnerability lies in how Craft CMS processes criteria arrays for element queries. The application allows users to specify relationships and ordering through these methods, but it does not strictly enforce a whitelist of allowed keys within certain nested configuration structures. Specifically, the Yii framework supports dynamic property assignment via "as" or "on" config keys, which are typically used for attaching event handlers to objects. When an authenticated user passes uncleansed criteria containing these specific keys into getNext, getPrev, or getOwners, Craft CMS inadvertently registers them as valid configuration directives. This bypasses the intended security boundaries of the Twig sandbox and other input filtering layers that normally restrict what actions a frontend or content editor can perform.
By injecting Yii "as" or "on" config keys, an attacker can attach malicious event handlers to elements during the query execution phase. These handlers are triggered automatically when the element query is processed by the application server. Because these events execute within the context of the web process, any code defined in the attached handler runs with the same privileges as the web user account hosting Craft CMS. This effectively allows an authenticated attacker to achieve arbitrary remote code execution on the server infrastructure without needing elevated system-level permissions or direct file write access outside of standard application directories.
The operational impact of this vulnerability is severe for organizations relying on Craft CMS for content management and digital experience delivery. Since authentication is required, the attack surface is limited to compromised accounts or users with legitimate but potentially weak credentials. However, once an attacker gains entry, they can execute arbitrary PHP code, leading to full server compromise. This includes the ability to read sensitive data such as database credentials, user sessions, and proprietary content; modify website files to install webshells for persistent access; pivot into internal networks if the web server is accessible from other segments; or deface the application. The vulnerability undermines the integrity of the entire CMS environment because it bypasses standard sandboxing mechanisms designed to prevent authenticated users from performing administrative actions.
Mitigation strategies must prioritize immediate patching and strict input validation. Administrators should upgrade Craft CMS to version 5.11.0 or later, where this issue has been resolved by enforcing stricter whitelisting of allowed keys in element query criteria. Until the update is applied, organizations can implement web application firewall rules to detect and block requests containing suspicious Yii configuration patterns such as "as" or "on" within specific API endpoints related to getNext, getPrev, or getOwners. Additionally, ensuring that database credentials are isolated with minimal privileges reduces the blast radius if an exploit succeeds. Regular audits of user roles should also be conducted to ensure that only trusted personnel have access to the Control Panel and its associated APIs.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) due to the execution of arbitrary code via injected configuration keys. It is further categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command if considering the broader impact on server integrity. In terms of adversary tactics, this exploit maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically PHP execution, as well as T1190 Exploit Public-Facing Application, given its presence in a widely used web application framework. The use of event handlers for code execution also reflects aspects of T1203 Executable File Deployment, where the attacker leverages legitimate system mechanisms to run malicious payloads. Understanding these mappings helps security teams align their detection rules and incident response procedures with established industry standards for similar exploitation patterns in content management systems.