Summaryinfo

A vulnerability was found in Craft CMS up to 5.9.12. It has been rated as problematic. The impacted element is the function cleanseConfig. Performing a manipulation of the argument fieldLayouts results in use of externally-controlled input to select classes or code. This vulnerability is identified as CVE-2026-33157. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Craft CMS up to 5.9.12. This affects the function cleanseConfig. The manipulation of the argument fieldLayouts with an unknown input leads to a use of externally-controlled input to select classes or code vulnerability. CWE is classifying the issue as CWE-470. The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a bypass of a previous fix. The existing patches add cleanseConfig() to assembleLayoutFromPost() and various FieldsController actions to strip Yii2 behavior/event injection keys ("as" and "on" prefixed keys). However, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without any sanitization, enabling the same behavior injection attack chain. This issue has been patched in version 5.9.13.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-33157 since 03/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but no exploit is available.

Upgrading to version 5.9.13 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Craft

Name

• CMS

Version

• 5.9.0
• 5.9.1
• 5.9.2
• 5.9.3
• 5.9.4
• 5.9.5
• 5.9.6
• 5.9.7
• 5.9.8
• 5.9.9
• 5.9.10
• 5.9.11
• 5.9.12

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion