CVE-2026-86730

Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Published Sep 8, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().

Analysis

Technical impact

Craft CMS versions before 5.10.12 allow authenticated control‑panel users to inject Yii2 behaviour attachments and event handlers by posting field‑layout tab elements as JSON strings, bypassing the platform’s cleanse validation. The attacker can then trigger arbitrary PHP object instantiation via Craft::createObject(), leading to remote code execution on the web server.

Affected Systems

The vulnerable product is Craft CMS, produced by craftcms. Versions earlier than 5.10.12 are affected and are identified by the CPE string cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*.

Risk and Exploitability

The CVSS score of 8.7 highlights a high severity vulnerability. EPSS information is not available, and the flaw is not listed in the CISA KEV catalogue. Exploitation requires an authenticated control‑panel account with the ability to edit field layouts; the attacker then injects malicious JSON, causing Craft to instantiate arbitrary objects and execute malicious code. The overall risk is moderate to high, especially in environments where control‑panel access is widely distributed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

craftcms

cms

unaffected

Version	Status	Constraints
`5.0.0-RC1`	affected	< 5.10.12
`5.10.12`	unaffected	—

No data.

Vendor Product Versions

Craftcms

Cms

Version	Status	Scheme	Platform
`[5.0.0-RC1,5.10.12)`	affected	semver	—
`5.10.12`	unaffected	semver	—

Craftcms

Craft Cms

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Craft CMS to version 5.10.12 or newer.
Limit control‑panel user privileges to the minimum required; disable field‑layout editing for untrusted accounts.
Review current field‑layout configurations and remove any suspicious or malformed JSON elements to eliminate residual malicious behaviors.

Generated by OpenCVE AI on September 8, 2026 at 16:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.707% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/craftcms/cms/security/advisories/GHSA-qj4v-m29p-fj4m
https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.12-behavior-injection-rce

History

Sep 8, 2026 5:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Craftcms cms
Vendors & Products		Craftcms cms

Sep 8, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 8, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
Title		Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
First Time appeared		Craftcms Craftcms craft Cms
Weaknesses		CWE-94
CPEs		cpe:2.3:a:craftcms:craft_cms::::::::
Vendors & Products		Craftcms Craftcms craft Cms
References		https://github.com/craftcms/cms/security/advisories/GHSA-qj4v-m29p-fj4m https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.12-behavior-injection-rce
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`