CVE-2026-112774 in Craft CMS
Summary
by MITRE • 10/19/2026
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
Craft CMS versions prior to 5.11.0, specifically affecting releases from 5.8.0 onwards, contain a critical remote code execution vulnerability within the ContentBlock::setFieldLayout method. This flaw stems from an improper validation of input data passed through JSON-string field layouts. The vulnerability allows authenticated administrators with specific privileges to inject Yii framework behaviors into the application's configuration structure. By manipulating the layout definition, attackers can introduce malicious PHP behavior declarations that are subsequently executed by the underlying web server process.
The technical mechanism relies on the way Craft CMS processes field layout configurations during content block operations. When a user supplies a JSON string representing a field layout to setFieldLayout(), the system attempts to parse and apply these settings. However, the validation logic fails to adequately sanitize or restrict certain keys within this configuration array. Specifically, if an attacker includes 'as X' or 'on X' keys in the payload, they can bypass the cleanseConfig() function which is designed to filter out dangerous configurations. These specific keys correspond to Yii's behavior attachment syntax, allowing arbitrary PHP code execution when the layout is processed and applied to content models.
The operational impact of this vulnerability is severe due to its potential for remote code execution with high privileges. Since Craft CMS typically runs under the context of a web server user account such as www-data or nginx, successful exploitation grants an attacker full control over that process identity. This enables the execution of arbitrary operating system commands on the host machine hosting the application. Furthermore, this level of access facilitates unauthorized disclosure of sensitive secrets stored within the environment variables, configuration files, or database credentials accessible to the web user account. The risk is significantly amplified in environments where allowAdminChanges is enabled, as it permits administrative changes without requiring a full site rebuild, thereby providing an easier path for exploitation by authenticated users who have been granted this specific permission set.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code or Script and CWE-78 OS Command Injection within the Common Weakness Enumeration framework. In terms of adversary tactics, it maps to ATT&CK technique T1059 Command and Scripting Interpreter for executing arbitrary commands via PHP scripts, as well as T1530 Data from Cloud Storage Object if secrets are exfiltrated to external locations. The vulnerability highlights a critical failure in input validation where trusted administrative inputs were not sufficiently sanitized before being passed to dynamic code execution mechanisms within the framework layer.
Mitigation strategies must prioritize immediate patching of Craft CMS to version 5.11.0 or later, which addresses this specific parsing flaw and strengthens the cleanseConfig() function against behavior injection attacks. Administrators should also review their server configurations to ensure that allowAdminChanges is disabled unless absolutely necessary for development purposes, as enabling it expands the attack surface for authenticated users. Additionally, implementing strict web application firewall rules can help detect anomalous JSON payloads containing Yii-specific syntax patterns such as 'as' or 'on' keys within field layout definitions. Regular auditing of administrative privileges and enforcing principle of least privilege will further reduce the risk of exploitation by limiting which user accounts possess the ability to modify critical system configurations.