Is CVE-2026-112774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112774 being exploited in the wild.

How severe is CVE-2026-112774?

High severity, with a CVSS score of 7.2, published 19 October 2026.

How is CVE-2026-112774 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112774?

Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112774: Craft CMS authenticated admin RCE via ContentBlock field-layout

CVE-2026-112774 · Severity: high · CVSS 7.2 · Published 2026-10-19

Craft CMS, a content management platform, contains a remote code execution vulnerability in how it processes field layout configurations. Authenticated administrators with a specific setting enabled (allowAdminChanges) can inject malicious code to execute arbitrary OS commands and access sensitive environment secrets. An attacker with admin privileges can gain full control of the web server where Craft CMS runs.

Technologies: Craft CMS. Vendors: Craft.

Quick answers

Is CVE-2026-112774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112774 being exploited in the wild.
How severe is CVE-2026-112774?: High severity, with a CVSS score of 7.2, published 19 October 2026.
Which products and versions are affected?: Craft CMS 5.8.0 to 5.10.x.
Is there a fix for CVE-2026-112774?: Yes: fixed in 5.11.0. Until then: Disable the allowAdminChanges setting if not required for your operational workflow, or restrict admin access to trusted users only until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112774 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112774?: Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.11.0

Disable the allowAdminChanges setting if not required for your operational workflow, or restrict admin access to trusted users only until upgrading.

Technical details

The vulnerability exists in ContentBlock::setFieldLayout() which JSON-decodes a field layout configuration string after sanitization, passing it to Fields::createLayout() without re-sanitizing. Attackers can bypass cleanseConfig() by injecting Yii behavior/event gadgets using 'as X' or 'on X' keys, achieving code injection during object hydration. This requires authenticated admin access with allowAdminChanges enabled (the default configuration), and results in remote code execution as the web user.

Affected products

Craft CMS 5.8.0 to 5.10.x

Timeline

2026-10-05: disclosed
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.