Craft CMS versions 5.8.0 through 5.10.x contain a flaw that lets an authenticated administrator inject custom Yii behavior by submitting a specially crafted JSON‑string field layout to the ContentBlock::setFieldLayout() method. The vulnerability bypasses the cleanseConfig() routine when allowAdminChanges is enabled, allowing the attacker to include 'as X' or 'on X' keys that trigger the execution of operating‑system commands under the web server process. Result is remote code execution and potential disclosure of secrets.

The flaw affects the Craft CMS content management system from the craftcms:cms vendor. All installations running Craft CMS version 5.8.0 through any 5.10.x release are vulnerable until the issue is patched.

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS data is not published, so the current likelihood of exploitation is uncertain. The flaw is not listed in the CISA KEV catalog, but it requires an authenticated administrative account and the allowAdminChanges option to be active. Attackers with these prerequisites can achieve full control of the host by executing arbitrary OS commands, making this a serious security risk for affected sites.