PT-2026-27462 · Pixel & Tonic · Craft Cms

Yuma4869 · Publicado 2026-03-24 · Atualizado 2026-05-06 · CVE-2026-33157

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.x through 5.9.12

Description Craft CMS contains a Remote Code Execution (RCE) issue that bypasses previous security fixes. This allows any authenticated user with control panel access to potentially execute arbitrary code. The issue stems from insufficient sanitization of the fieldLayouts parameter in the ElementIndexesController::actionFilterHud() function, which is passed directly to FieldLayout::createFromConfig() without proper cleansing. Specifically, the fieldLayouts parameter is not processed with cleanseConfig(), unlike the conditionConfig parameter. This enables the injection of Yii2 behavior/event keys (such as "as" and "on" prefixed keys), leading to the instantiation of arbitrary objects and ultimately, the execution of shell commands via a chain of events involving Component:: get(), call user func(), and shell exec().

Recommendations Craft CMS versions 4.x through 5.9.12 should be updated to version 5.9.13 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-470

Identificadores relacionados

CVE-2026-33157

GHSA-2FPH-6V5W-89HH

Produtos afetados

Craft Cms

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33157.json · Exploit
• https://github.com/craftcms/cms · Nota
• https://github.com/craftcms/cms/security/advisories/GHSA-2fph-6v5w-89hh · Aviso do Fabricante
• https://github.com/craftcms/cms/commit/97e90b4bdee369c1af3ca77a77531132df240e4e · Correção
• https://github.com/craftcms/cms/releases/tag/5.9.13 · Nota
• https://github.com/advisories/GHSA-255j-qw47-wjh5 · Nota
• https://twitter.com/dailycve/status/2052111300415639935 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33157 · Aviso do Fabricante
• https://github.com/advisories/GHSA-7jx7-3846-m7w7 · Nota
• https://osv.dev/vulnerability/GHSA-2fph-6v5w-89hh · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33157 · Nota de Segurança