Executive brief
Craft CMS is a popular content management system used to manage website content and structure. Authenticated control panel users can exploit a validation bypass in field-layout configuration to inject malicious code that executes on the server, potentially leading to complete system compromise. This requires an account with control panel access but no special admin permissions.
Technical details
The vulnerability is a code injection flaw (CWE-94) in field-layout element cleansing. Craft CMS uses Component::cleanseConfig() to strip dangerous Yii2 configuration keys (behavior attachments and event handlers) from user input before passing data to Craft::createObject(). However, cleanseConfig only recurses into arrays; when field-layout tab elements are posted as JSON strings, they bypass cleanse validation. The FieldLayoutTab constructor later decodes the string into an array, resurrecting malicious "on" and "as" keys that flow through to Craft::createObject() for arbitrary object instantiation and event handler execution. Any authenticated control panel user can reach this attack path; no admin role or special permissions required. Patches available in version 5.10.12 and later.
Affected products
- Craft CMS >=5.0.0-RC1, <5.10.12
Timeline
- 2026-08-25: disclosed: GitHub Security Advisory GHSA-qj4v-m29p-fj4m published
- 2026-09-08: advisory: CVE-2026-86730 published
- 2026-09-08: patched: Fix available in version 5.10.12