{"id":"CVE-2026-44011","published":"2026-05-12T20:25:08Z","modified":"2026-05-13T15:37:25Z","title":"Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.6,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0062,"percentile":0.49581,"provenance":"source"},"cwes":[{"id":"CWE-479","name":"Signal Handler Use of a Non-reentrant Function"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qrgm-p9w5-rrfw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/commit/ab85ca7f5f926994f723f60584054a1f4c4c5de3","tags":["x_refsource_MISC"]}],"priority":{"score":20.9,"factors":[{"name":"EPSS percentile","points":9.92},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.02}]},"exploitSources":{"pocGithub":{"count":6,"skipped":0,"earliest":"2026-09-21","earliestUrl":"https://github.com/TRX-0/CVE-2026-44011-craftcms-rce","repos":[{"name":"4xura/CVE-2026-44011-craftcms-auth-rce","url":"https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce","stars":6,"created":"2026-09-27"},{"name":"Cyberuser-hash/CVE-2026-44011-craft-rce-poc","url":"https://github.com/Cyberuser-hash/CVE-2026-44011-craft-rce-poc","stars":2,"created":"2026-09-27"},{"name":"khush-613/CVE-2026-44011-poc","url":"https://github.com/khush-613/CVE-2026-44011-poc","stars":1,"created":"2026-09-27"},{"name":"TRX-0/CVE-2026-44011-craftcms-rce","url":"https://github.com/TRX-0/CVE-2026-44011-craftcms-rce","stars":0,"created":"2026-09-21"},{"name":"DENNISDGR/CVE-2026-44011-poc","url":"https://github.com/DENNISDGR/CVE-2026-44011-poc","stars":0,"created":"2026-09-27"}]},"first":{"date":"2026-09-21","source":"PoC-in-GitHub","url":"https://github.com/TRX-0/CVE-2026-44011-craftcms-rce"},"provenance":"source"},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 4.0.0, < 4.17.12",">= 5.0.0, < 5.9.18"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.0.0, <4.17.12",">=5.0.0, <5.9.18"],"patched":["4.17.12","5.9.18"],"from":["GHSA-qrgm-p9w5-rrfw"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-29835","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-craft-cms-cms-cve-2025-68455","parents":[{"from":"CVE-2025-68455","to":"CVE-2026-44011","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-qrgm-p9w5-rrfw","via":"reference","url":"https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5"}]}],"packageHistory":[{"cve":"CVE-2026-41129","published":"2026-04-21","fixed":"5.9.15","kev":false,"link":{"from":"CVE-2026-41129","to":"CVE-2026-44011","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.17.9","toFixed":"4.17.12","daysApart":21},{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"5.9.15","toFixed":"5.9.18","daysApart":21}]}},{"cve":"CVE-2026-41130","published":"2026-04-21","fixed":"5.9.15","kev":false},{"cve":"CVE-2026-44010","published":"2026-05-12","fixed":"5.9.18","kev":false},{"cve":"CVE-2026-44011","published":"2026-05-12","fixed":"5.9.18","kev":false},{"cve":"CVE-2026-44012","published":"2026-05-12","fixed":"5.9.18","kev":false},{"cve":"CVE-2026-50279","published":"2026-07-01","fixed":"5.9.21","kev":false},{"cve":"CVE-2026-50280","published":"2026-07-01","fixed":"5.9.21","kev":false},{"cve":"CVE-2026-50282","published":"2026-07-02","fixed":"5.9.21","kev":false,"link":{"from":"CVE-2026-44011","to":"CVE-2026-50282","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.17.12","toFixed":"4.17.14","daysApart":51}]}},{"cve":"CVE-2026-50283","published":"2026-07-01","fixed":"5.9.21","kev":false,"link":{"from":"CVE-2026-44011","to":"CVE-2026-50283","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.17.12","toFixed":"4.17.14","daysApart":50}]}}],"package":"Packagist:craftcms/cms"}}