PT-2026-27462 · Pixel & Tonic · Craft Cms

Yuma4869 · Published 2026-03-24 · Updated 2026-05-06 · CVE-2026-33157

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.x through 5.9.12

Description Craft CMS contains a Remote Code Execution (RCE) issue that bypasses previous security fixes. This allows any authenticated user with control panel access to potentially execute arbitrary code. The issue stems from insufficient sanitization of the fieldLayouts parameter in the ElementIndexesController::actionFilterHud() function, which is passed directly to FieldLayout::createFromConfig() without proper cleansing. Specifically, the fieldLayouts parameter is not processed with cleanseConfig(), unlike the conditionConfig parameter. This enables the injection of Yii2 behavior/event keys (such as "as" and "on" prefixed keys), leading to the instantiation of arbitrary objects and ultimately, the execution of shell commands via a chain of events involving Component:: get(), call user func(), and shell exec().

Recommendations Craft CMS versions 4.x through 5.9.12 should be updated to version 5.9.13 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2026-33157

GHSA-2FPH-6V5W-89HH

Affected Products

Craft Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33157.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-2fph-6v5w-89hh · Vendor Advisory
• https://github.com/craftcms/cms/commit/97e90b4bdee369c1af3ca77a77531132df240e4e · Patch
• https://osv.dev/vulnerability/CVE-2026-33157 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2fph-6v5w-89hh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33157 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.9.13 · Note
• https://github.com/advisories/GHSA-255j-qw47-wjh5 · Note
• https://twitter.com/dailycve/status/2052111300415639935 · Twitter Post
• https://github.com/advisories/GHSA-7jx7-3846-m7w7 · Note