8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68455

CVE-2025-68455: Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68455

CVE-2025-68455:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.8.20	5.8.21
craftcms/cms	composer	>= 4.0.0-RC1, <= 4.16.16	4.16.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because Craft CMS, which is built on the Yii framework, did not properly sanitize user-provided configuration data before using it to instantiate or configure components. An attacker with administrator privileges could send a specially crafted JSON payload to specific controller actions. This payload would abuse the Yii framework's object configuration features to attach a malicious 'Behavior' (yii\behaviors\AttributeTypecastBehavior) to a component. By subsequently triggering an event on that component, the attacker could execute arbitrary code on the server.

The analysis of the provided patches confirms this root cause. The patches consistently add calls to a Component::cleanseConfig() function in the src/controllers/FieldsController.php file. This function is used to sanitize configuration arrays received from user requests, specifically removing potentially dangerous keys like __class, __construct(), and event handlers (on *) that enable the exploit.

The vulnerable functions were identified by locating where this sanitization was added. The patches directly modify actionRenderCardPreview and the helper methods _fldComponent and _fldComponentConfig. The vulnerability report explicitly mentions the endpoint /admin/actions/fields/apply-layout-element-settings, which corresponds to an action that relies on these patched helper methods. Therefore, these functions are the points where the malicious input is processed and are the key indicators of the vulnerability being triggered.

Vulnerable functions

craft\controllers\FieldsController::actionRenderCardPreview

src/controllers/FieldsController.php

The function `actionRenderCardPreview` was vulnerable because it used user-provided data from the `fieldLayoutConfig` request parameter to create a `FieldLayout` object without proper sanitization. This allowed an attacker to inject a malicious Yii Behavior, leading to Remote Code Execution. The patch mitigates this by cleansing the configuration array using `Component::cleanseConfig` before object creation.

craft\controllers\FieldsController::_fldComponent

src/controllers/FieldsController.php

The private helper function `_fldComponent` processes the `layoutConfig` and `config` parameters from the request. Before the patch, this data was not sanitized, making any controller action that uses this helper (like `actionApplyLayoutElementSettings`) vulnerable to RCE via malicious Yii Behavior injection. The patch adds calls to `Component::cleanseConfig` to sanitize the input.

craft\controllers\FieldsController::_fldComponentConfig

src/controllers/FieldsController.php

The private helper function `_fldComponentConfig` merges configuration arrays from the request. It was vulnerable because the merged configuration was not sanitized before being returned and used. An attacker could craft the request parameters to inject a malicious Yii Behavior. The patch addresses this by calling `Component::cleanseConfig` on the merged configuration before returning it.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.