Vulnerability-Lookup

CVE-2026-25498 (GCVE-0-2026-25498)

Vulnerability from cvelistv5 – Published: 2026-02-09 19:55 – Updated: 2026-02-10 15:59

Title

Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

Summary

Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22.

Severity ?

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/craftcms/cms/security/advisori…	x_refsource_CONFIRM
	https://github.com/craftcms/cms/commit/395c64f0b8…	x_refsource_MISC
	https://github.com/craftcms/cms/releases/tag/5.8.22	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	craftcms	cms	Affected: >= 5.0.0-RC1, < 5.8.22 Affected: >= 4.0.0-RC1, < 4.16.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25498",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T15:32:09.006023Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T15:59:54.896Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cms",
          "vendor": "craftcms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-RC1, \u003c 5.8.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0-RC1, \u003c 4.16.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T19:55:06.558Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7"
        },
        {
          "name": "https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748"
        },
        {
          "name": "https://github.com/craftcms/cms/releases/tag/5.8.22",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/craftcms/cms/releases/tag/5.8.22"
        }
      ],
      "source": {
        "advisory": "GHSA-7jx7-3846-m7w7",
        "discovery": "UNKNOWN"
      },
      "title": "Craft has a potential authenticated Remote Code Execution via malicious attached Behavior"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25498",
    "datePublished": "2026-02-09T19:55:06.558Z",
    "dateReserved": "2026-02-02T16:31:35.824Z",
    "dateUpdated": "2026-02-10T15:59:54.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-25498\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-09T20:15:58.510\",\"lastModified\":\"2026-02-19T19:20:46.393\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22.\"},{\"lang\":\"es\",\"value\":\"Craft es una plataforma para crear experiencias digitales. En las versiones 4.0.0-RC1 hasta la 4.16.17 y 5.0.0-RC1 hasta la 5.8.21, existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) en Craft CMS donde la funci\u00f3n assembleLayoutFromPost() en src/services/Fields.PHP no logra sanear los datos de configuraci\u00f3n proporcionados por el usuario antes de pasarlos a Craft::createObject(). Esto permite a los administradores autenticados inyectar configuraciones de comportamiento maliciosas de Yii2 que ejecutan comandos de sistema arbitrarios en el servidor. Esta vulnerabilidad representa una variante sin parchear de la vulnerabilidad de inyecci\u00f3n de comportamiento abordada en CVE-2025-68455, afectando a diferentes puntos finales a trav\u00e9s de una ruta de c\u00f3digo separada. Esta vulnerabilidad se corrige en la 5.8.22.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-470\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*\",\"versionStartExcluding\":\"4.0.0\",\"versionEndExcluding\":\"4.16.18\",\"matchCriteriaId\":\"29EBFBEA-6CFF-49DD-BEE0-3E65E89DEA2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*\",\"versionStartExcluding\":\"5.0.0\",\"versionEndExcluding\":\"5.8.22\",\"matchCriteriaId\":\"E1C69442-81E7-4695-B09C-E7811765D283\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"610F6DE9-720F-45B3-81D5-18E7F6B090FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC2F40FC-7C27-456A-B16D-679410D1D5CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FBAA8227-04F8-404C-907B-B0162B325F5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"21B28E2C-327A-4CE6-ACAD-97E459712A55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C7461CF-35AB-48E1-88B6-956DAE1D2AB4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D8E02D1-601A-4E2B-B619-4775BFDB72D0\"}]}]}],\"references\":[{\"url\":\"https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/craftcms/cms/releases/tag/5.8.22\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\",\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-25498\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-10T15:32:09.006023Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-10T15:32:09.713Z\"}}], \"cna\": {\"title\": \"Craft has a potential authenticated Remote Code Execution via malicious attached Behavior\", \"source\": {\"advisory\": \"GHSA-7jx7-3846-m7w7\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"craftcms\", \"product\": \"cms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 5.0.0-RC1, \u003c 5.8.22\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0.0-RC1, \u003c 4.16.18\"}]}], \"references\": [{\"url\": \"https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7\", \"name\": \"https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748\", \"name\": \"https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/craftcms/cms/releases/tag/5.8.22\", \"name\": \"https://github.com/craftcms/cms/releases/tag/5.8.22\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-470\", \"description\": \"CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-09T19:55:06.558Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-25498\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-10T15:59:54.896Z\", \"dateReserved\": \"2026-02-02T16:31:35.824Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-09T19:55:06.558Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-7JX7-3846-M7W7

Vulnerability from github – Published: 2026-02-09 20:36 – Updated: 2026-02-09 22:39

Summary

Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Details

Relationship to Previously Patched Vulnerability

This vulnerability is in addition to the RCE vulnerability patched in GHSA-255j-qw47-wjh5. That advisory addressed a similar RCE vulnerability that affected two specific routes:

/index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings
/index.php?p=admin%2Factions%2Ffields%2Frender-card-preview

This one addresses some additional endpoints that were not covered in the https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5.

The patched vulnerability used a malicious AttributeTypecastBehavior with a wildcard event listener ("on *": "self::beforeSave") and __construct() syntax to trigger RCE via the typecastBeforeSave callback. The fix was implemented in commits: - 6e608a1 - 27f5588 - ec43c49

This vulnerability follows the same attack pattern (behavior injection via "as <behavior>" syntax) but affects a different code path (assembleLayoutFromPost() in Fields.php) that was not patched in those commits. The attack vector uses typecastAfterValidate instead of typecastBeforeSave and does not require the wildcard event listener syntax, demonstrating that multiple entry points exist for this type of vulnerability.

Executive Summary

A Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in GHSA-255j-qw47-wjh5, affecting different endpoints through a separate code path.

Vulnerability Details

Attack Prerequisites

Authentication: Admin-level access required
Network Access: Access to admin panel (/admin)

Location

File: src/services/Fields.php
Function: assembleLayoutFromPost() (lines 1125-1143)
Root Cause: Missing cleanseConfig() call on user-supplied fieldLayout POST parameter

Vulnerable Code Path

// src/services/Fields.php:1125-1133
public function assembleLayoutFromPost(?string $namespace = null): FieldLayout
{
    $paramPrefix = $namespace ? rtrim($namespace, '.') . '.' : '';
    $request = Craft::$app->getRequest();
    $config = JsonHelper::decode($request->getBodyParam("{$paramPrefix}fieldLayout"));
    // ... additional config values added ...
    $layout = $this->createLayout($config);  // <-- No cleanseConfig() call!
    // ...
}

// src/services/Fields.php:1089-1093
public function createLayout(array $config): FieldLayout
{
    $config['class'] = FieldLayout::class;
    return Craft::createObject($config);  // <-- Untrusted data passed directly
}

Attack Chain

The exploitation leverages Yii2's object configuration system and behavior attachment mechanism:

Behavior Injection: Attacker includes 'as rce' key in the fieldLayout JSON POST parameter
Object Creation: Craft::createObject() processes the config through Yii2's BaseYii::configure()
Behavior Attachment: Yii2's Component::__set() detects the 'as ' prefix and attaches the behavior
RCE Trigger: When validate() is called on the model, EVENT_AFTER_VALIDATE fires
Command Execution: AttributeTypecastBehavior calls the configured typecast function (ConsoleProcessus::execute) with the uid attribute value as the command

RCE Gadget Chain

FieldLayout POST parameter
    → Craft::createObject()
    → Yii2 Component::__set() with 'as rce' key
    → AttributeTypecastBehavior attached
    → Model::validate() called
    → EVENT_AFTER_VALIDATE triggered
    → typecastAfterValidate → typecastAttributes()
    → call_user_func(['Psy\Readline\Hoa\ConsoleProcessus', 'execute'], $command)
    → Shell command execution

Affected Controllers

The assembleLayoutFromPost() function is called by multiple admin controllers:

Controller	Action	Permission Required
`TagsController`	`actionSaveTagGroup()`	Admin
`CategoriesController`	`actionSaveGroup()`	Admin
`EntryTypesController`	`actionSave()`	Admin
`GlobalsController`	`actionSaveSet()`	Admin
`VolumesController`	`actionSave()`	Admin
`UsersController`	`actionSaveUserFieldLayout()`	Admin
`AddressesController`	`actionSaveAddressFieldLayout()`	Admin

References

https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748
GHSA-255j-qw47-wjh5 - Previously patched RCE vulnerability via behavior injection (affecting different endpoints)
CVE-2024-4990 - Related vulnerability that inspired the behavior injection attack pattern
Yii2 GHSA-gcmh-9pjj-7fp4 - Original Yii framework report (framework team declined to fix at framework level)

Severity ?

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.8.21"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.8.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.16.17"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.16.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25498"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-09T20:36:43Z",
    "nvd_published_at": "2026-02-09T20:15:58Z",
    "severity": "HIGH"
  },
  "details": "## Relationship to Previously Patched Vulnerability\n\nThis vulnerability is **in addition to** the RCE vulnerability patched in [GHSA-255j-qw47-wjh5](https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5). That advisory addressed a similar RCE vulnerability that affected two specific routes:\n\n- `/index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings`\n- `/index.php?p=admin%2Factions%2Ffields%2Frender-card-preview`\n\nThis one addresses some additional endpoints that were not covered in the https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5.\n\nThe patched vulnerability used a malicious `AttributeTypecastBehavior` with a wildcard event listener (`\"on *\": \"self::beforeSave\"`) and `__construct()` syntax to trigger RCE via the `typecastBeforeSave` callback. The fix was implemented in commits:\n- [6e608a1](https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef)\n- [27f5588](https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7)\n- [ec43c49](https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593)\n\nThis vulnerability follows the same attack pattern (behavior injection via `\"as \u003cbehavior\u003e\"` syntax) but affects a **different code path** (`assembleLayoutFromPost()` in `Fields.php`) that was **not patched** in those commits. The attack vector uses `typecastAfterValidate` instead of `typecastBeforeSave` and does not require the wildcard event listener syntax, demonstrating that multiple entry points exist for this type of vulnerability.\n\n---\n\n## Executive Summary\n\nA Remote Code Execution (RCE) vulnerability exists in Craft CMS where the `assembleLayoutFromPost()` function in `src/services/Fields.php` fails to sanitize user-supplied configuration data before passing it to `Craft::createObject()`. This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an **unpatched variant** of the behavior injection vulnerability addressed in GHSA-255j-qw47-wjh5, affecting different endpoints through a separate code path.\n\n---\n\n## Vulnerability Details\n\n### Attack Prerequisites\n\n- **Authentication:** Admin-level access required\n- **Network Access:** Access to admin panel (`/admin`)\n\n---\n\n\n### Location\n\n- **File:** `src/services/Fields.php`\n- **Function:** `assembleLayoutFromPost()` (lines 1125-1143)\n- **Root Cause:** Missing `cleanseConfig()` call on user-supplied `fieldLayout` POST parameter\n\n### Vulnerable Code Path\n\n```php\n// src/services/Fields.php:1125-1133\npublic function assembleLayoutFromPost(?string $namespace = null): FieldLayout\n{\n    $paramPrefix = $namespace ? rtrim($namespace, \u0027.\u0027) . \u0027.\u0027 : \u0027\u0027;\n    $request = Craft::$app-\u003egetRequest();\n    $config = JsonHelper::decode($request-\u003egetBodyParam(\"{$paramPrefix}fieldLayout\"));\n    // ... additional config values added ...\n    $layout = $this-\u003ecreateLayout($config);  // \u003c-- No cleanseConfig() call!\n    // ...\n}\n\n// src/services/Fields.php:1089-1093\npublic function createLayout(array $config): FieldLayout\n{\n    $config[\u0027class\u0027] = FieldLayout::class;\n    return Craft::createObject($config);  // \u003c-- Untrusted data passed directly\n}\n```\n---\n\n## Attack Chain\n\nThe exploitation leverages Yii2\u0027s object configuration system and behavior attachment mechanism:\n\n1. **Behavior Injection:** Attacker includes `\u0027as rce\u0027` key in the `fieldLayout` JSON POST parameter\n2. **Object Creation:** `Craft::createObject()` processes the config through Yii2\u0027s `BaseYii::configure()`\n3. **Behavior Attachment:** Yii2\u0027s `Component::__set()` detects the `\u0027as \u0027` prefix and attaches the behavior\n4. **RCE Trigger:** When `validate()` is called on the model, `EVENT_AFTER_VALIDATE` fires\n5. **Command Execution:** `AttributeTypecastBehavior` calls the configured typecast function (`ConsoleProcessus::execute`) with the `uid` attribute value as the command\n\n### RCE Gadget Chain\n\n```\nFieldLayout POST parameter\n    \u2192 Craft::createObject()\n    \u2192 Yii2 Component::__set() with \u0027as rce\u0027 key\n    \u2192 AttributeTypecastBehavior attached\n    \u2192 Model::validate() called\n    \u2192 EVENT_AFTER_VALIDATE triggered\n    \u2192 typecastAfterValidate \u2192 typecastAttributes()\n    \u2192 call_user_func([\u0027Psy\\Readline\\Hoa\\ConsoleProcessus\u0027, \u0027execute\u0027], $command)\n    \u2192 Shell command execution\n```\n\n---\n\n## Affected Controllers\n\nThe `assembleLayoutFromPost()` function is called by multiple admin controllers:\n\n| Controller | Action | Permission Required |\n|------------|--------|---------------------|\n| `TagsController` | `actionSaveTagGroup()` | Admin |\n| `CategoriesController` | `actionSaveGroup()` | Admin |\n| `EntryTypesController` | `actionSave()` | Admin |\n| `GlobalsController` | `actionSaveSet()` | Admin |\n| `VolumesController` | `actionSave()` | Admin |\n| `UsersController` | `actionSaveUserFieldLayout()` | Admin |\n| `AddressesController` | `actionSaveAddressFieldLayout()` | Admin |\n\n---\n## References\n\n- https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748\n- [GHSA-255j-qw47-wjh5](https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5) - Previously patched RCE vulnerability via behavior injection (affecting different endpoints)\n- [CVE-2024-4990](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4990) - Related vulnerability that inspired the behavior injection attack pattern\n- [Yii2 GHSA-gcmh-9pjj-7fp4](https://github.com/yiisoft/yii2/security/advisories/GHSA-gcmh-9pjj-7fp4) - Original Yii framework report (framework team declined to fix at framework level)\n\n---",
  "id": "GHSA-7jx7-3846-m7w7",
  "modified": "2026-02-09T22:39:16Z",
  "published": "2026-02-09T20:36:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25498"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/4.16.18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/5.8.22"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior"
}

FKIE_CVE-2026-25498

Vulnerability from fkie_nvd - Published: 2026-02-09 20:15 - Updated: 2026-02-09 21:55

Severity ?

8.6 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748
	security-advisories@github.com	https://github.com/craftcms/cms/releases/tag/5.8.22
	security-advisories@github.com	https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22."
    }
  ],
  "id": "CVE-2026-25498",
  "lastModified": "2026-02-09T21:55:30.093",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-09T20:15:58.510",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/craftcms/cms/releases/tag/5.8.22"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-470"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-25498 (GCVE-0-2026-25498)

GHSA-7JX7-3846-M7W7

Relationship to Previously Patched Vulnerability

Executive Summary

Vulnerability Details

Attack Prerequisites

Location

Vulnerable Code Path

Attack Chain

RCE Gadget Chain

Affected Controllers

References

FKIE_CVE-2026-25498

Tags

Sightings

Nomenclature