Description
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 5.0.0-RC1 – < 5.10.12 | 5.10.12 |
References
- GitHub Security Advisory (GHSA-qj4v-m29p-fj4m) vendor-advisory
- VulnCheck Advisory: Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE third-party-advisory