Vulnerabilities

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by…

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Craft CMS, PHP

Product

Craft CMS, PHP

CVSS

7.2

Exposure class

Web platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-112774 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 15
   CVE NVD 12d ago

   Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are…

   CVSS 7.2 CVE-2026-112777 Craft CMS PHP
2. 15
   CVE NVD 12d ago

   Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig…

   CVSS 8.8 CVE-2026-112773 Craft CMS PHP
3. 15
   CVE NVD 12d ago

   Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig…

   CVSS 8.8 CVE-2026-112772 Craft CMS PHP
4. 8
   CVE NVD 12d ago

   Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index…

   CVSS 6.5 CVE-2026-112771 Craft CMS PHP
5. 15
   CVE NVD 12d ago

   Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string…

   CVSS 8.8 CVE-2026-112770 Craft CMS PHP