CVE-2026-33157
Description
Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a bypass of a previous fix. The existing patches add cleanseConfig() to assembleLayoutFromPost() and various FieldsController actions to strip Yii2 behavior/event injection keys ("as" and "on" prefixed keys). However, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without any sanitization, enabling the same behavior injection attack chain. This issue has been patched in version 5.9.13.
How to fix
- craftcms craft_cms5.9.13 or later
- craftcms/cms5.9.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| craftcms craft_cms | 5.6.0 ≤ v < 5.9.13 | 5.9.13 |
| craftcms/cmsPackagist | 5.6.0 ≤ v < 5.9.13 | 5.9.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.