CVE-2026-44011-poc

CVE-2026-44011 Authenticated RCE in Craft CMS via Yii behavior injection. Affected: 4.0.0–4.17.11, 5.0.0–5.9.17 Fixed in: 4.17.12, 5.9.18 Advisory: GHSA-qrgm-p9w5-rrfw Vulnerability The /admin/actions/element-search/search endpoint accepts a condition parameter that gets passed directly into...

CVE-2026-28695-craft-rce-bypass

CVE-2026-28695 patch bypass — Craft CMS ≤ 5.9.8 authenticated RCE element-search CVSS 3.x : 8.8 HIGH approx — verify CWE : CWE-502 Unsafe Object Instantiation + CWE-1336 SSTI origin Base : CVE-2026-28695 SSTI via create + Symfony Process Fix : advisory fix e31e508 restricts create to BaseObject —...

CVE-2025-32432

CVE-2025-32432 — Craft CMS = 5.6.16 Unauthenticated RCE Severity: Critical CVSS 10.0 Auth required: None Affected: Craft CMS 3.0.0-RC1 - 3.9.14, 4.0.0-RC1 - 4.14.14, 5.0.0-RC1 - 5.6.16 Patched in: Craft CMS 3.9.15 / 4.14.15 / 5.6.17, Yii2 2.0.50 Identify How to Confirm the Target is Vulnerable...

Yii 2 < 2.0.38 - Remote Code Execution

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. id: CVE-2020-15148 info: name: Yii 2 2.0.38 - Remote Code Execution author: pikpikcu severity: critical description: Yii 2 yiisoft/yii2 before version 2.0....

EUVD-2026-109206

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938

In Craft CMS , an authenticated control panel user can exploit a vulnerability where the allowed column filter delegates property lookups to Yii ArrayHelper , bypassing the Twig sandbox 's security policies. By submitting an element-search condition, an attacker can use repeated single-segment lo...

PT-2026-122243

Name of the Vulnerable Software and Affected Versions Craft CMS affected versions not specified Description Authenticated control panel users can submit an element-search condition where the element selector is evaluated as a sandboxed Twig object template. The column filter delegates property...

CVE-2026-112774

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

CVE-2026-112774 Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

CVE-2026-112774 Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

CVE-2026-112774 Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

EUVD-2026-104580

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

CVE-2026-112774

Craft CMS versions 5.8.0 before 5.11.0 are vulnerable to Remote Code Execution (RCE) . The flaw exists in the ContentBlock::setFieldLayout() function, where authenticated administrators can inject Yii behaviors by providing a JSON-string field layout. If the allowAdminChanges setting is enabled, ...

CVE-2026-112774: Improper Control of Generation of Code

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

PT-2026-117625

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.8.0 through 5.10.x Description Authenticated administrators can achieve remote code execution by supplying a JSON-string field layout to the setFieldLayout function within the ContentBlock class. When the allowAdminChanges...

Craft CMS code injection vulnerability

Versions of Craft CMS from 5.8.0 to 5.11.0 have a code injection vulnerability. This vulnerability stems from improper handling of JSON string fields passed into the ContentBlock::setFieldLayout method. It allows authenticated administrators to inject Yii behaviors. Attackers who have enabled...

Exploit for CVE-2026-44011

CVE-2026-44011 Authenticated RCE in Craft CMS via Yii behavio...

CVE-2025-32432

CVE-2025-32432 — Craft CMS = 5.6.16 Unauthenticated RCE Severity: Critical CVSS 10.0 Auth required: None Affected: Craft CMS 3.0.0-RC1 - 3.9.14, 4.0.0-RC1 - 4.14.14, 5.0.0-RC1 - 5.6.16 Patched in: Craft CMS 3.9.15 / 4.14.15 / 5.6.17, Yii2 2.0.50 Identify How to Confirm the Target is Vulnerable...