8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25498

CVE-2026-25498: Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25498

CVE-2026-25498:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.8.21	5.8.22
craftcms/cms	composer	>= 4.0.0-RC1, <= 4.16.17	4.16.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Craft CMS due to a failure to sanitize user-supplied configuration data in the assembleLayoutFromPost function located in src/services/Fields.php. This function takes a fieldLayout parameter from a POST request, decodes it from JSON, and then uses it to create a FieldLayout object via the createLayout function. The createLayout function, in turn, passes the configuration to Craft::createObject(). Without sanitization, an authenticated administrator can inject a malicious Yii2 behavior configuration into the fieldLayout parameter. This allows for the attachment of a behavior that can execute arbitrary system commands on the server, resulting in Remote Code Execution. The patch for this vulnerability, found in commit 395c64f0b80b507be1c862a2ec942eaacb353748, addresses the root cause by adding a call to ComponentHelper::cleanseConfig() within the assembleLayoutFromPost function. This ensures that any potentially malicious configuration is removed before it can be processed.

Vulnerable functions

craft\services\Fields::assembleLayoutFromPost

src/services/Fields.php

The `assembleLayoutFromPost` function is vulnerable as it decodes user-supplied JSON from the `fieldLayout` POST parameter and uses it to create a `FieldLayout` object without prior sanitization. The patch introduces a call to `ComponentHelper::cleanseConfig()` to sanitize the input, thus mitigating the vulnerability. An attacker could previously provide a malicious configuration that would lead to Remote Code Execution.

craft\services\Fields::createLayout

src/services/Fields.php

The `createLayout` function is part of the vulnerable code path. It takes the configuration array, which is unsanitized in the vulnerable version, and passes it to `Craft::createObject()`. This is the final step before the malicious configuration is processed by the Yii2 framework, leading to RCE. Although this function was not patched itself, it is the direct caller of the object creation that triggers the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.