Is CVE-2026-86730 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86730 being exploited in the wild.

How severe is CVE-2026-86730?

High severity, with a CVSS score of 8.8, published 8 September 2026.

Which products and versions are affected?

Craft CMS >=5.0.0-RC1, <5.10.12.

Is there a fix for CVE-2026-86730?

A patch was published on 2026-09-08: Fix available in version 5.10.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86730 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86730?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86730: Craft CMS behavior injection in field-layout elements

Q: Is there a fix for CVE-2026-86730?

A patch was published on 2026-09-08: Fix available in version 5.10.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-86730 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-86730?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86730 · Severity: high · CVSS 8.8 · Published 2026-09-08

Craft CMS is a popular content management system used to manage website content and structure. Authenticated control panel users can exploit a validation bypass in field-layout configuration to inject malicious code that executes on the server, potentially leading to complete system compromise. This requires an account with control panel access but no special admin permissions.

Quick answers

Is CVE-2026-86730 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86730 being exploited in the wild.
How severe is CVE-2026-86730?: High severity, with a CVSS score of 8.8, published 8 September 2026.
Which products and versions are affected?: Craft CMS >=5.0.0-RC1, <5.10.12.
Is there a fix for CVE-2026-86730?: A patch was published on 2026-09-08: Fix available in version 5.10.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86730 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86730?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a code injection flaw (CWE-94) in field-layout element cleansing. Craft CMS uses Component::cleanseConfig() to strip dangerous Yii2 configuration keys (behavior attachments and event handlers) from user input before passing data to Craft::createObject(). However, cleanseConfig only recurses into arrays; when field-layout tab elements are posted as JSON strings, they bypass cleanse validation. The FieldLayoutTab constructor later decodes the string into an array, resurrecting malicious "on" and "as" keys that flow through to Craft::createObject() for arbitrary object instantiation and event handler execution. Any authenticated control panel user can reach this attack path; no admin role or special permissions required. Patches available in version 5.10.12 and later.

Affected products

Craft CMS >=5.0.0-RC1, <5.10.12

Timeline

2026-08-25: disclosed: GitHub Security Advisory GHSA-qj4v-m29p-fj4m published
2026-09-08: advisory: CVE-2026-86730 published
2026-09-08: patched: Fix available in version 5.10.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.