Skip to content
OpenAdvisories
High · 8.6 Public exploit CVE-2026-44011 EUVD-2026-29835GHSA-qrgm-p9w5-rrfw

Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

Published May 12, 2026 · Updated May 13, 2026 · Assigned by GitHub_M

Vendor: craftcms Product: cms Package: craftcms/cms Ecosystem: Packagist

Description

Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.

Affected products

VendorProductAffectedFixed
craftcms cms >= 4.0.0, < 4.17.12, >= 5.0.0, < 5.9.18 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 6 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist craftcms/cms >= 4.0.0, < 4.17.12 4.17.12 GHSA-qrgm-p9w5-rrfw
Packagist craftcms/cms >= 5.0.0, < 5.9.18 5.9.18 GHSA-qrgm-p9w5-rrfw

References