CVE-2026-112774

7.2High

Published 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-94

Impact

Authenticated administrators can execute arbitrary OS commands and access secrets as the web server user. Exploitation requires administrative privileges on sites where allowAdminChanges is enabled.

Root cause

The cleanseConfig() function fails to block 'as X' or 'on X' keys in JSON field layouts passed to ContentBlock::setFieldLayout(), enabling Yii behavior injection.

Affected systems

Craft CMS 5.8.0 before 5.11.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Craft CMS to version 5.11.0 or later. If patching immediately is not possible, disable administrative changes by setting allowAdminChanges to false in your config/general.php.

shell

$ composer update craftcms/cms --with-dependencies

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112774