CVE-2026-86730 in Craftcms
Summary
by MITRE • 09/08/2026
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/08/2026
Craft CMS versions prior to 5.10.12 contain a critical server-side request forgery vulnerability rooted in improper input sanitization within the control panel's field-layout management subsystem. The core technical flaw lies in the application's failure to adequately cleanse string-typed field-layout elements, specifically when these elements are submitted as JSON strings via POST requests. This deficiency allows authenticated users with access to the control panel interface to inject malicious Yii2 behavior attachments and event handlers directly into the system configuration. By exploiting this weakness, an attacker can bypass standard validation mechanisms that typically filter out dangerous object instantiation patterns, thereby gaining a foothold for further exploitation within the application's runtime environment.
The operational impact of this vulnerability is severe, as it facilitates arbitrary code execution on the server hosting the Craft CMS instance. The attack vector relies on the interaction between the malformed input and the Yii2 framework's dependency injection container, specifically through the use of the Craft::createObject() method. When an attacker posts a crafted field-layout tab element containing serialized PHP objects or specific configuration arrays that mimic valid behavior definitions, the application processes this data without sufficient scrutiny. This leads to the instantiation of arbitrary classes defined by the attacker rather than intended system components. Consequently, if these instantiated classes contain executable logic in their constructors or event handlers, it results in remote code execution with the privileges of the web server process, potentially leading to full compromise of the underlying infrastructure and exposure of sensitive data stored within the CMS database.
From a classification perspective, this vulnerability aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), as well as CWE-502 regarding Deserialization of Untrusted Data if the JSON parsing involves unvalidated object reconstruction. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit maps to T1190 Exploit Public-Facing Application and potentially T1059 Command and Scripting Interpreter depending on how the executed code is leveraged post-exploitation. The requirement for authentication means that while it does not affect anonymous users, it poses a significant risk in environments where user accounts may be compromised through phishing or credential stuffing attacks, allowing an insider threat to escalate privileges significantly beyond their intended scope.
Mitigation strategies must prioritize immediate patching of the Craft CMS installation to version 5.10.12 or later, as this release addresses the input validation logic for field-layout elements. Administrators should also enforce strict role-based access control within the control panel to limit which user roles can modify structural configurations such as field layouts and entry types. Additionally, implementing a Web Application Firewall with rules capable of detecting anomalous JSON payloads containing PHP object serialization patterns or suspicious Yii2 behavior definitions can provide an additional layer of defense against exploitation attempts. Regular security audits focusing on input sanitization practices in custom modules or plugins are also recommended to prevent similar vulnerabilities from being introduced through third-party extensions that may interact with the same underlying framework components.