Live › vulnerability › CVE-2026-112774
Go to dashboardCraft CMS 5.8.0 before 5.11.0 lets an authenticated administrator inject Yii behaviors through a JSON field layout passed to ContentBlock::setFieldLayout(). The injected 'as X' or 'on X' keys bypass cleanseConfig(), so the attacker runs OS commands as the web user and can read secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
5.8.0 up to but not including 5.11.0 is affected5.11.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-112774")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.