CVE-2026-44011

Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.

Scoring

Severity

HIGH

CVSS base score

8.6

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS probability

0.36%

CWE

CWE-479

Published

2026-05-12

Last modified

2026-05-13

Affected products

• craftcms cms
• craftcms cms

Weakness type

• CWE-479

Related vulnerabilities

• CVE-2021-26948 — Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary...

Markdown version · Browse all CVEs