CVE-2026-33157

Katalog CVE

CVSS 7.2 · High EPSS 1,1%

Kerentanan Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') pada craftcms craft cms. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a bypass of a previous fix. The existing patches add cleanseConfig() to assembleLayoutFromPost() and various FieldsController actions to strip Yii2 behavior/event injection keys ("as" and "on" prefixed keys). However, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without any sanitization, enabling the same behavior injection attack chain. This issue has been patched in version 5.9.13.

Rincian

Terbit di NVD

24 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/craftcms/cms/security/advisories/GHSA-2fph-6v5w-89hh exploit · advisory vendor
• https://github.com/craftcms/cms/commit/97e90b4bdee369c1af3ca77a77531132df240e4e patch
• https://github.com/craftcms/cms/releases/tag/5.9.13 release notes