CVE-2026-112774: Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.11.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Craft CMS versions from 5.8.0 up to, but not including, 5.11.0 are affected. Exploitation also requires that allowAdminChanges is enabled.
What access does an attacker need?
The attacker must be an authenticated administrator. They can supply a JSON-string field layout to ContentBlock::setFieldLayout() containing "as X" or "on X" keys to inject Yii behaviors.
What is the impact of successful exploitation?
An attacker can execute operating-system commands as the web user. This can also expose secrets accessible to that web-user account.
What can be done if an immediate upgrade is not possible?
Disable allowAdminChanges to remove the stated exploitation prerequisite, and restrict administrator access. Upgrade to Craft CMS 5.11.0 or later when possible.