Craft CMS versions 4.0.0 through 4.17.11 and all 5.x releases prior to 5.9.18 contain an input handling flaw in a Yii object creation path that allows an authenticated user to add malicious configuration data. The flaw occurs because configuration from user-controlled payloads is applied before the parent constructor is called, enabling attacker-controlled special keys to influence object instantiation. This can lead to arbitrary command execution on the server, constituting a high severity vulnerability.

Affected systems are Craft CMS installations running any version from 4.0.0 up to and including 4.17.11, as well as all 5.x releases before 5.9.18. The flaw is present in the framework’s handling of FieldLayout objects processed during a same-request event.

The CVSS score of 8.6 indicates a high impact, while the EPSS score is not available, making it unclear how frequently exploits have been observed. The vulnerability is not listed in the CISA KEV catalog. Attack exploitation requires the attacker to be an authenticated user with permissions to upload or edit content that triggers the bad configuration path. Once accessed, the flaw can be leveraged to execute arbitrary commands on the host system.