CVE-2026-112774

Publié : 19 octobre 2026

Modifié : 19 octobre 2026

Score CVSS

7.2

HIGH

Description détaillée

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://github.com/craftcms/cms/security/advisories/GHSA-j6r9-fxgv-j7x5 https://www.vulncheck.com/advisories/craft-cms-5.8.0-before-5.11.0-admin-rce-via-contentblock-field-layout

Dernières Vulnérabilités

CVE-2026-57513

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-57512

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-56714

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS