CVE-2026-25498

Undergoing Analysis Undergoing Analysis - In Progress

Remote Code Execution in Craft CMS assembleLayoutFromPost() Function

Publication date: 2026-02-09

Last updated on: 2026-02-19

Assigner: GitHub, Inc.

Description

Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-09

Last Modified

2026-02-19

Generated

2026-07-06

AI Q&A

2026-02-09

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25498

EUVD

EUVD-2026-6844

Affected Vendors & Products

Vendor	Product	Version / Range
craftcms	craft_cms	4.0.0
craftcms	craft_cms	4.0.0
craftcms	craft_cms	4.0.0
craftcms	craft_cms	4.0.0
craftcms	craft_cms	5.0.0
craftcms	craft_cms	5.0.0
craftcms	craft_cms	From 4.0.0 (exc) to 4.16.18 (exc)
craftcms	craft_cms	From 5.0.0 (exc) to 5.8.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. It is a Remote Code Execution (RCE) issue caused by the assembleLayoutFromPost() function in src/services/Fields.php not properly sanitizing user-supplied configuration data before passing it to Craft::createObject().

As a result, authenticated administrators can inject malicious Yii2 behavior configurations that allow execution of arbitrary system commands on the server.

This vulnerability is an unpatched variant of a previously addressed behavior injection vulnerability (CVE-2025-68455), but it affects different endpoints through a separate code path. It was fixed in version 5.8.22.

Impact Analysis

This vulnerability allows an authenticated administrator to execute arbitrary system commands on the server hosting the Craft CMS application.

Such remote code execution can lead to full system compromise, including unauthorized access to sensitive data, modification or deletion of data, disruption of services, and potential use of the server as a pivot point for further attacks.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Craft CMS to version 5.8.22 or later, where the issue is fixed.

Additionally, restrict administrative access to trusted users only, as the vulnerability requires authenticated administrator privileges.

Hi! I’m here to help you understand CVE-2026-25498. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70