A flaw in Craft CMS versions 5.6.0 to 5.9.12 permits an authenticated user with control‑panel access to execute arbitrary code on the underlying web server. The issue stems from unsanitized configuration data that allows a malicious "as" key to be injected into the field layout system, causing the CMS to instantiate and run arbitrary PHP code. This results in full remote code execution on the host.

All installations of Craft CMS running between version 5.6.0 and 5.9.12, inclusive, are vulnerable if they expose a control‑panel interface to users. The flaw was fixed in Craft CMS 5.9.13, which cleanses the fieldLayouts parameter in the ElementIndexesController to prevent the injection of behaviors.

The CVSS score of 8.6 denotes high severity, while the EPSS score of less than 1% indicates it has not yet been widely observed in the wild and the vulnerability is not listed in CISA’s KEV catalog. However, the attack requires no advanced privileges beyond a normal authenticated user, meaning the potential impact remains significant. Administrators should therefore treat this as a critical issue and apply the patch immediately or otherwise eliminate the use of affected versions.