CVE-2026-86730

Craft CMS versions from 5.0.0-RC1 before 5.10.12 are vulnerable to Remote Code Execution (RCE) due to improper cleansing of string-typed field-layout elements. An authenticated control-panel user can post field-layout tab elements as JSON strings to bypass cleanse validation, injecting Yii2 behav...