CVE-2026-44011

Katalog CVE

CVSS 8.6 · High EPSS 0,44%

Kerentanan Signal Handler Use of a Non-reentrant Function. Skor CVSS 4.0 8.6 (High) menurut github.com.

Deskripsi (NVD)

Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.

Rincian

Terbit di NVD

12 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

8.6 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-479: Signal Handler Use of a Non-reentrant Function

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/craftcms/cms/commit/ab85ca7f5f926994f723f60584054a1f4c4c5de3
• https://github.com/craftcms/cms/security/advisories/GHSA-qrgm-p9w5-rrfw