CVE-2026-86730: Craft CMS RCE Vulnerability

CVE-2026-86730 Overview

Craft CMS versions before 5.10.12 contain a code injection vulnerability [CWE-94] in the field-layout element handling logic. The flaw allows authenticated control-panel users to inject Yii2 behavior attachments and event handlers by posting field-layout tab elements as JSON strings. This bypasses the cleanse validation applied to string-typed field-layout elements. Attackers then trigger arbitrary object instantiation through Craft::createObject(), leading to remote code execution on the underlying server. The vulnerability affects Craft CMS releases from 5.0.0-rc1 up to (but not including) 5.10.12.

Critical Impact
Authenticated control-panel users can achieve remote code execution on the host running Craft CMS, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

Craft CMS 5.0.0-rc1 through versions prior to 5.10.12
Deployments exposing the control panel to untrusted authenticated users
Multi-tenant Craft CMS installations with delegated content editors

Discovery Timeline

2026-09-08 - CVE-2026-86730 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86730

Vulnerability Analysis

Craft CMS relies on the Yii2 framework, which exposes a powerful object configuration pattern through Craft::createObject(). This method accepts an associative array describing a class name along with property values, behaviors, and event handlers. When Craft deserializes user-submitted field-layout tab elements, it performs a cleanse pass on structured input to strip disallowed keys such as as behaviorName and on eventName. The cleanse routine treats string-typed elements as inert, assuming they contain no configurable Yii2 metadata.

Attackers exploit this trust boundary by submitting field-layout tab elements as JSON strings rather than as native arrays. The application later decodes these strings and forwards the resulting structures into Craft::createObject() without re-applying the cleanse pass. The injected as and on keys are then interpreted as behavior attachments and event handlers, enabling instantiation of arbitrary classes with attacker-controlled constructor arguments.

Root Cause

The root cause is inconsistent input sanitization between array-typed and string-typed field-layout elements. String payloads bypass the validator that would otherwise strip Yii2 configuration directives before object hydration.

Attack Vector

Exploitation requires an authenticated session with control-panel access. The attacker submits a crafted POST request to a field-layout endpoint containing a serialized JSON element with embedded behavior definitions. When Craft processes the layout, it invokes Craft::createObject() on the attacker-supplied configuration, executing the referenced class logic in the web server context.

Refer to the GitHub Security Advisory GHSA-qj4v-m29p-fj4m and the VulnCheck Advisory on Craft CMS for the full technical breakdown.

// No verified public exploit code is available for this CVE.
// See the vendor advisory for reproduction details.

Detection Methods for CVE-2026-86730

Indicators of Compromise

POST requests to Craft control-panel field-layout endpoints containing JSON strings with as or on keys embedded in element definitions.
Unexpected PHP processes spawned by the web server user immediately following control-panel activity.
New or modified files under Craft's storage/ or web-root directories not associated with a known deployment.
Outbound network connections initiated by the PHP-FPM or web server process to unfamiliar hosts.

Detection Strategies

Inspect HTTP request bodies destined for /admin/ field-layout save actions and flag payloads containing the substrings "as " or "on " inside JSON string values.
Monitor Craft application logs and web server access logs for authenticated users performing bulk field-layout edits followed by system-level activity.
Correlate control-panel authentication events with process-execution telemetry from the underlying host to identify anomalous child processes of the web server.

Monitoring Recommendations

Enable verbose logging in Craft CMS for field-layout mutations and forward logs to a centralized SIEM for correlation.
Baseline the set of accounts with control-panel access and alert on privilege changes or new administrator accounts.
Track outbound egress from web-tier servers and alert on connections to non-approved destinations.

How to Mitigate CVE-2026-86730

Immediate Actions Required

Upgrade Craft CMS to version 5.10.12 or later on all production and staging environments.
Audit control-panel user accounts and remove or rotate credentials for accounts that no longer require access.
Review recent field-layout changes and application logs for signs of exploitation prior to patching.

Patch Information

The Craft CMS maintainers released version 5.10.12 to address the behavior injection flaw. The fix reapplies the cleanse validation to string-typed field-layout elements after JSON decoding, preventing as and on keys from reaching Craft::createObject(). Details are documented in the Craft CMS security advisory GHSA-qj4v-m29p-fj4m.

Workarounds

Restrict control-panel access to trusted administrators using network-level controls such as IP allowlisting or VPN gating until patching completes.
Disable or reduce permissions on content-editor roles that can modify field layouts.
Deploy a web application firewall rule that inspects field-layout POST bodies and blocks requests containing as or on keys within JSON string values.

bash

# Example: upgrade Craft CMS via Composer
composer require craftcms/cms:^5.10.12 --update-with-dependencies
php craft up