CVE-2026-44011 Details
Description
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.
A remote code execution vulnerability has been identified in Craft CMS versions 4.0.0 prior to 4.17.12 and 5.0.0 prior to 5.9.18. The issue arises from an input-handling flaw in the Yii object creation process, allowing any authenticated user to inject malicious configuration that is executed on the server. This vulnerability exploits the dynamic object configuration feature of Yii, which Craft CMS uses to build application components from a settings list. The flaw was introduced by not properly sanitizing condition field layout data before it was processed, enabling the execution of arbitrary commands on the server.
Users can upgrade to Craft CMS versions 4.17.12 or 5.9.18 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms/security/advisories/GHSA-qrgm-p9w5-rrfw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/craftcms/cms/commit/ab85ca7f5f926994f723f60584054a1f4c4c5de3 | [email protected] | Source CodeVendor |
| https://github.com/craftcms/cms/security/advisories/GHSA-qrgm-p9w5-rrfw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-479 | Signal Handler Use of a Non-reentrant Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Craft CMS | >= 4.0.0, < 4.17.12 (semver) >= 5.0.0, < 5.9.18 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |