# CVE-2026-25498: cms RCE — Fixed in 5.8.22

🐘 Packagist

Not in CISA KEV

# CVE-2026-25498 — cms

[Fix: craftcms/cms@395c64f](https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748)

CVE-2026-25498 is a CWE-470 vulnerability in craftcms/cms. A fix is available for craftcms/cms — see the affected versions and patch details below.

Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

Also known as[GHSA-7jx7-3846-m7w7](/vulnerability/GHSA-7jx7-3846-m7w7)

Published

Feb 9, 2026

Updated

Oct 28, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   A successful exploit gives an attacker total control of the affected component, not partial access.
-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25498.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

1.1%probability of exploitation in next 30 days

Lower Risk\-0.02%

Lower risk than most CVEs66th percentile — riskier than 66% of all scored CVEsHighest risk

0.00%0.56%1.13%1.69%0.3%1.1%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

2 pkgs affected

🐘`craftcms/cms`🐘`craftcms/cms`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

## Description

### Relationship to Previously Patched Vulnerability

This vulnerability is **in addition to** the RCE vulnerability patched in [GHSA-255j-qw47-wjh5](https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5). That advisory addressed a similar RCE vulnerability that affected two specific routes:

-   `/index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings`
-   `/index.php?p=admin%2Factions%2Ffields%2Frender-card-preview`

This one addresses some additional endpoints that were not covered in the [https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5](https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5).

The patched vulnerability used a malicious `AttributeTypecastBehavior` with a wildcard event listener (`"on *": "self::beforeSave"`) and `__construct()` syntax to trigger RCE via the `typecastBeforeSave` callback. The fix was implemented in commits:

-   [6e608a1](https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef)
-   [27f5588](https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7)
-   [ec43c49](https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593)

This vulnerability follows the same attack pattern (behavior injection via `"as <behavior>"` syntax) but affects a **different code path** (`assembleLayoutFromPost()` in `Fields.php`) that was **not patched** in those commits. The attack vector uses `typecastAfterValidate` instead of `typecastBeforeSave` and does not require the wildcard event listener syntax, demonstrating that multiple entry points exist for this type of vulnerability.

* * *

### Executive Summary

A Remote Code Execution (RCE) vulnerability exists in Craft CMS where the `assembleLayoutFromPost()` function in `src/services/Fields.php` fails to sanitize user-supplied configuration data before passing it to `Craft::createObject()`. This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an **unpatched variant** of the behavior injection vulnerability addressed in GHSA-255j-qw47-wjh5, affecting different endpoints through a separate code path.

* * *

### Vulnerability Details

#### Attack Prerequisites

-   **Authentication:** Admin-level access required
-   **Network Access:** Access to admin panel (`/admin`)

* * *

#### Location

-   **File:** `src/services/Fields.php`
-   **Function:** `assembleLayoutFromPost()` (lines 1125-1143)
-   **Root Cause:** Missing `cleanseConfig()` call on user-supplied `fieldLayout` POST parameter

#### Vulnerable Code Path

```
// src/services/Fields.php:1125-1133
public function assembleLayoutFromPost(?string $namespace = null): FieldLayout
{
    $paramPrefix = $namespace ? rtrim($namespace, '.') . '.' : '';
    $request = Craft::$app->getRequest();
    $config = JsonHelper::decode($request->getBodyParam("{$paramPrefix}fieldLayout"));
    // ... additional config values added ...
    $layout = $this->createLayout($config);  // <-- No cleanseConfig() call!
    // ...
}

// src/services/Fields.php:1089-1093
public function createLayout(array $config): FieldLayout
{
    $config['class'] = FieldLayout::class;
    return Craft::createObject($config);  // <-- Untrusted data passed directly
}
```

* * *

### Attack Chain

The exploitation leverages Yii2's object configuration system and behavior attachment mechanism:

1.  **Behavior Injection:** Attacker includes `'as rce'` key in the `fieldLayout` JSON POST parameter
2.  **Object Creation:** `Craft::createObject()` processes the config through Yii2's `BaseYii::configure()`
3.  **Behavior Attachment:** Yii2's `Component::__set()` detects the `'as '` prefix and attaches the behavior
4.  **RCE Trigger:** When `validate()` is called on the model, `EVENT_AFTER_VALIDATE` fires
5.  **Command Execution:** `AttributeTypecastBehavior` calls the configured typecast function (`ConsoleProcessus::execute`) with the `uid` attribute value as the command

#### RCE Gadget Chain

```
FieldLayout POST parameter
    → Craft::createObject()
    → Yii2 Component::__set() with 'as rce' key
    → AttributeTypecastBehavior attached
    → Model::validate() called
    → EVENT_AFTER_VALIDATE triggered
    → typecastAfterValidate → typecastAttributes()
    → call_user_func(['Psy\Readline\Hoa\ConsoleProcessus', 'execute'], $command)
    → Shell command execution
```

* * *

### Affected Controllers

The `assembleLayoutFromPost()` function is called by multiple admin controllers:

Controller

Action

Permission Required

`TagsController`

`actionSaveTagGroup()`

Admin

`CategoriesController`

`actionSaveGroup()`

Admin

`EntryTypesController`

`actionSave()`

Admin

`GlobalsController`

`actionSaveSet()`

Admin

`VolumesController`

`actionSave()`

Admin

`UsersController`

`actionSaveUserFieldLayout()`

Admin

`AddressesController`

`actionSaveAddressFieldLayout()`

Admin

* * *

### References

-   [https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748](https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748)
-   [GHSA-255j-qw47-wjh5](https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5) - Previously patched RCE vulnerability via behavior injection (affecting different endpoints)
-   [CVE-2024-4990](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4990) - Related vulnerability that inspired the behavior injection attack pattern
-   [Yii2 GHSA-gcmh-9pjj-7fp4](https://github.com/yiisoft/yii2/security/advisories/GHSA-gcmh-9pjj-7fp4) - Original Yii framework report (framework team declined to fix at framework level)

* * *

## Affected Packages

2 total 2 fixed

Ecosystem

Package

Vulnerable range

Fix

🐘Packagist

`craftcms/cms` 

≥ 5.0.0-RC1&&< 5.8.22

5.8.22`composer require craftcms/cms:^5.8.22`

🐘Packagist

`craftcms/cms` 

≥ 4.0.0-RC1&&< 4.16.18

4.16.18`composer require craftcms/cms:^4.16.18`

## Affected Products

1 product · 8 configurations

Application

`craft cms`craftcms

\> 5.0.0 && < 5.8.22

2 versions

4.0.05.0.0

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update craftcms/cms to 5.8.22 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25498 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
    

## Frequently Asked Questions

\## Relationship to Previously Patched Vulnerability This vulnerability is \*\*in addition to\*\* the RCE vulnerability patched in \[GHSA-255j-qw47-wjh5\](https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5). That advisory addressed a similar RCE vulnerability that affected two specific routes: - \`/index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings\` - \`/index.php?p=admin%2Factions%2Ffields%2Frender-card-preview\` This one addresses some additional endpoints that were not covered in the https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5. Th

O3 Security · Impact-Aware SCA

### Is CVE-2026-25498 in your dependencies?

Find it across Packagist, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)