Craft CMS: Remote code execution via ContentBlock field layout
Summary
Craft CMS versions 5.8.0 up to but not including 5.11.0 allow an authenticated administrator to execute operating system commands as the web user through the ContentBlock field layout. The attacker supplies a crafted JSON field layout that bypasses the configuration sanitization and injects a Yii behavior, which can also disclose secrets. The attack requires allowAdminChanges to be enabled, which is the default; the vendor rates the issue Low, while the CNA's CVSS v4.0 score is 8.7 High.
Affected
- Craft CMS 5.8.0 up to but not including 5.11.0
- Unclear: OSV also lists 5.8.11, 5.9.11 and 5.10.11. Verify against the vendor advisory before relying on this.
Fixed in
- Upgrade to Craft CMS 5.11.0 or later (5.11.x line).
Workaround
- Keep allowAdminChanges disabled in production. This is an inference from the advisory, not a vendor-confirmed workaround.
- Restrict control panel access and enforce strong admin authentication, including MFA.
Exploitation
- No evidence of exploitation in the wild was found. CISA KEV status was not verified.
- VulDB labels the status 0-Day and states exploitation appears easy. This is VulDB's assessment, not evidence of attacks.
- CISA SSVC assessment: exploitation none, not automatable.
- No public proof of concept was found.
Our recommendation
- Inventory Craft CMS installations and their versions (craftcms/cms in composer.lock).
- Upgrade installations on 5.8.0 up to 5.10.x to 5.11.0 or later.
- Check whether allowAdminChanges is enabled in production and disable it if it is not required.
- Restrict control panel access and review admin accounts.
- Review logs for unexpected admin activity and rotate secrets and API keys if compromise is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-j6r9-fxgv-j7x5 github.com
- VulnCheck advisory: Craft CMS 5.8.0 before 5.11.0 Admin RCE www.vulncheck.com
- OSV: CVE-2026-112774 osv.dev
- VulDB entry 422518 vuldb.com
- Craft CMS 5.11.0 release notes (mirror) newreleases.io
- Tenable: CVE-2026-112774 www.tenable.com
- ACN alert on Craft CMS vulnerabilities www.acn.gov.it
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:01.
Original description (NVD)
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.