CVE-2026-25498
Remote Code Execution in Craft CMS assembleLayoutFromPost() Function
Publication date: 2026-02-09
Last updated on: 2026-02-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| craftcms | craft_cms | 4.0.0 |
| craftcms | craft_cms | 4.0.0 |
| craftcms | craft_cms | 4.0.0 |
| craftcms | craft_cms | 4.0.0 |
| craftcms | craft_cms | 5.0.0 |
| craftcms | craft_cms | 5.0.0 |
| craftcms | craft_cms | From 4.0.0 (exc) to 4.16.18 (exc) |
| craftcms | craft_cms | From 5.0.0 (exc) to 5.8.22 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-470 | The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. It is a Remote Code Execution (RCE) issue caused by the assembleLayoutFromPost() function in src/services/Fields.php not properly sanitizing user-supplied configuration data before passing it to Craft::createObject().
As a result, authenticated administrators can inject malicious Yii2 behavior configurations that allow execution of arbitrary system commands on the server.
This vulnerability is an unpatched variant of a previously addressed behavior injection vulnerability (CVE-2025-68455), but it affects different endpoints through a separate code path. It was fixed in version 5.8.22.
How can this vulnerability impact me? :
This vulnerability allows an authenticated administrator to execute arbitrary system commands on the server hosting the Craft CMS application.
Such remote code execution can lead to full system compromise, including unauthorized access to sensitive data, modification or deletion of data, disruption of services, and potential use of the server as a pivot point for further attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Craft CMS to version 5.8.22 or later, where the issue is fixed.
Additionally, restrict administrative access to trusted users only, as the vulnerability requires authenticated administrator privileges.