CVE-2026-33157: Craftcms Craft CMS RCE Vulnerability

CVE-2026-33157 Overview

CVE-2026-33157 is a Remote Code Execution (RCE) vulnerability affecting Craft CMS, a popular content management system. This vulnerability exists in versions 5.6.0 through 5.9.12 and can be exploited by any authenticated user with control panel access. The flaw represents a bypass of a previous security fix, allowing attackers to leverage Yii2 behavior/event injection through an unsanitized code path.

Critical Impact

Authenticated attackers with control panel access can achieve full remote code execution on the underlying server, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

• Craft CMS versions 5.6.0 to 5.9.12
• craftcms craft_cms

Discovery Timeline

• 2026-03-24 - CVE-2026-33157 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33157

Vulnerability Analysis

This vulnerability falls under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), which describes improper handling of user-controlled input when selecting classes or executing code. The root issue stems from an incomplete security patch that failed to cover all vulnerable code paths.

The previous patches implemented the cleanseConfig() function in assembleLayoutFromPost() and various FieldsController actions to strip Yii2 behavior and event injection keys (specifically keys prefixed with "as" and "on"). However, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() was overlooked, creating an alternative attack path that bypasses the existing protections.

The vulnerability can be exploited over the network without requiring user interaction, though it does require authentication with control panel access privileges.

Root Cause

The root cause is an incomplete security fix that failed to sanitize user input in all relevant code paths. While cleanseConfig() was applied to multiple controller actions to prevent Yii2 behavior injection, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without any sanitization.

The Yii2 framework supports behavior and event injection through specially prefixed configuration keys ("as" for behaviors and "on" for events). When these keys are present in configuration arrays, Yii2 automatically attaches behaviors or registers event handlers. Without proper sanitization, attackers can inject malicious behaviors that execute arbitrary code during object configuration.

Attack Vector

The attack targets the ElementIndexesController::actionFilterHud() endpoint within the Craft CMS control panel. An authenticated attacker can craft a malicious request containing the fieldLayouts parameter with Yii2 behavior injection keys. Since this parameter bypasses the cleanseConfig() sanitization, it flows directly into FieldLayout::createFromConfig(), triggering the behavior injection mechanism.

The attack chain involves injecting a configuration array with "as" or "on" prefixed keys that reference attacker-controlled classes or callbacks. When Yii2 processes this configuration, it instantiates the specified behavior class or executes the event handler, leading to arbitrary code execution on the server.

This vulnerability requires the attacker to have valid credentials with control panel access, making it a post-authentication attack. However, the impact is significant as it allows complete server compromise from a potentially lower-privileged CMS user account.

Detection Methods for CVE-2026-33157

Indicators of Compromise

• Unusual HTTP POST requests to ElementIndexesController::actionFilterHud() containing fieldLayouts parameters with "as" or "on" prefixed keys
• Unexpected process execution or file system modifications originating from the web server process
• Anomalous outbound network connections from the Craft CMS application server
• Log entries showing access to the filter HUD endpoint with abnormally large or encoded payloads

Detection Strategies

• Monitor web application logs for requests to /admin/element-indexes/filter-hud or similar endpoints containing suspicious parameter patterns
• Implement Web Application Firewall (WAF) rules to detect and block requests containing Yii2 behavior injection patterns ("as " and "on " prefixed keys in JSON/array parameters)
• Deploy file integrity monitoring on the Craft CMS installation directory to detect unauthorized modifications
• Configure intrusion detection systems to alert on command execution or shell spawning from the PHP process

Monitoring Recommendations

• Enable detailed access logging for the Craft CMS control panel and review logs for anomalous activity
• Implement application-level logging to capture requests to FieldLayout::createFromConfig() with external configuration sources
• Monitor for authenticated sessions performing unusual sequences of API calls that may indicate exploitation attempts
• Set up alerts for any code execution or system calls originating from the web application context

How to Mitigate CVE-2026-33157

Immediate Actions Required

• Upgrade Craft CMS to version 5.9.13 or later immediately
• Review control panel user accounts and remove unnecessary access privileges
• Audit recent control panel activity logs for suspicious behavior
• Consider temporarily restricting control panel access to trusted IP addresses until patching is complete

Patch Information

Craft CMS has released version 5.9.13 which addresses this vulnerability by extending the cleanseConfig() sanitization to cover the fieldLayouts parameter in ElementIndexesController::actionFilterHud(). The fix ensures that Yii2 behavior and event injection keys are properly stripped from all user-controlled configuration inputs.

The patch commit is available at the GitHub Commit Changes. For complete details, see the GitHub Security Advisory GHSA-2fph-6v5w-89hh and the GitHub Release Version 5.9.13.

Workarounds

• Restrict control panel access to only essential personnel with verified need
• Implement network-level access controls (IP whitelisting) for the Craft CMS admin interface
• Deploy a Web Application Firewall with rules to block requests containing Yii2 behavior injection patterns
• Consider running Craft CMS in a containerized environment with restricted system call capabilities

# Example: Restrict control panel access via .htaccess (Apache)
<Location "/admin">
    Require ip 10.0.0.0/8
    Require ip 192.168.1.0/24
</Location>

# Example: Restrict control panel access via nginx
location /admin {
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
}