CVE-2026-44011
Description
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.
How to fix
- craftcms/cms4.17.12, 5.9.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| craftcms/cmsPackagist | 4.0.0 ≤ v < 4.17.12, 5.0.0 ≤ v < 5.9.18 | 4.17.12, 5.9.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.