CVE-2026-112774

Deferred Deferred - Pending Action

Authenticated RCE in Craft CMS via Field Layout Injection

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112774

EUVD

EUVD-2026-104580

Affected Vendors & Products

Vendor	Product	Version / Range
craftcms	cms	5.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

Craft CMS versions 5.8.0 to 5.11.0 have a remote code execution vulnerability. Authenticated administrators can inject malicious Yii behaviors by providing a specially crafted JSON field layout to ContentBlock::setFieldLayout(). The vulnerability bypasses cleanseConfig() using 'as X' or 'on X' keys, allowing OS command execution as the web user and potential secret disclosure. The issue requires allowAdminChanges to be enabled.

Detection Guidance

Check Craft CMS version with composer show craftcms/cms or inspect the admin panel footer. If version is >=5.8.0 and <5.11.0, the system is vulnerable. Review admin settings for allowAdminChanges enabled. Inspect field layout JSON configurations in Content Blocks for suspicious 'as X' or 'on X' keys.

Impact Analysis

An attacker with admin access could execute arbitrary OS commands on the server running Craft CMS. This could lead to full system compromise, data theft, or unauthorized modifications. Attackers might also access sensitive environment variables or secrets stored on the server.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade Craft CMS to version 5.11.0 or later immediately. Disable allowAdminChanges setting in config/general.php. Audit field layout JSON configurations for malicious entries. Restrict admin access to trusted users only.

Hi! I’m here to help you understand CVE-2026-112774. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70