Description
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
Published: 2026-09-08
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Craft CMS versions before 5.10.12 allow authenticated control‑panel users to inject Yii2 behaviour attachments and event handlers by posting field‑layout tab elements as JSON strings, bypassing the platform’s cleanse validation. The attacker can then trigger arbitrary PHP object instantiation via Craft::createObject(), leading to remote code execution on the web server.

Affected Systems

The vulnerable product is Craft CMS, produced by craftcms. Versions earlier than 5.10.12 are affected and are identified by the CPE string cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*.

Risk and Exploitability

The CVSS score of 8.7 highlights a high severity vulnerability. EPSS information is not available, and the flaw is not listed in the CISA KEV catalogue. Exploitation requires an authenticated control‑panel account with the ability to edit field layouts; the attacker then injects malicious JSON, causing Craft to instantiate arbitrary objects and execute malicious code. The overall risk is moderate to high, especially in environments where control‑panel access is widely distributed.

Generated by OpenCVE AI on September 8, 2026 at 16:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Craft CMS to version 5.10.12 or newer.
  • Limit control‑panel user privileges to the minimum required; disable field‑layout editing for untrusted accounts.
  • Review current field‑layout configurations and remove any suspicious or malformed JSON elements to eliminate residual malicious behaviors.

Generated by OpenCVE AI on September 8, 2026 at 16:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
Title Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
First Time appeared Craftcms
Craftcms craft Cms
Weaknesses CWE-94
CPEs cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
Vendors & Products Craftcms
Craftcms craft Cms
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Craftcms Craft Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-08T15:36:22.493Z

Reserved: 2026-09-08T11:31:09.013Z

Link: CVE-2026-86730

cve-icon Vulnrichment

Updated: 2026-09-08T15:36:19.637Z

cve-icon NVD

Status : Received

Published: 2026-09-08T16:18:34.667

Modified: 2026-09-08T16:18:34.667

Link: CVE-2026-86730

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T16:30:07Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')