CVE-2026-86730: Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.12 - Compensating control
Restrict access to the Craft control panel to trusted users (authenticated control-panel users could exploit the issue in versions before 5.10.12).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated access to the Craft CMS control panel. The supplied data does not identify which control-panel roles or permissions are sufficient.
What does exploitation require?
The attacker must submit field-layout tab elements as JSON strings, bypassing cleanse validation for string-typed elements. They can then inject Yii2 behavior attachments and event handlers that lead to arbitrary object instantiation through Craft::createObject() and code execution.
Which versions are affected?
Craft CMS versions before 5.10.12 are affected, with the issue identified from 5.0.0-RC1 onward. Upgrading to 5.10.12 or later addresses the affected version range.