Craft CMS allows authenticated administrators to inject malicious Yii2 behavior configurations when creating or updating fields. The assembleLayoutFromPost() function does not sanitize user-supplied configuration data before passing it to Craft::createObject(), which can lead to arbitrary system command execution on the server. This results in a remote code execution vulnerability that compromises confidentiality, integrity, and availability of the affected installation.

Vulnerable versions include Craft CMS 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The issue was fixed in version 5.8.22. The vulnerability affects any instance where administrators can create or update fields with custom configuration data.

With a CVSS score of 8.6 the vulnerability is considered high severity. The EPSS score is under 1 %, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. However, the flaw requires administrator authentication, so attackers would need valid credentials to exploit it. If acquired, an exploit could allow complete takeover of the web application server.