CVE-2026-112774

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.8.0 through 5.10.x

Description Authenticated administrators can achieve remote code execution by supplying a JSON-string field layout to the setFieldLayout() function within the ContentBlock class. When the allowAdminChanges setting is enabled, attackers can bypass the cleanseConfig() function by including keys such as as X or on X to inject Yii behaviors. This allows the execution of operating system commands with the privileges of the web user and the disclosure of secrets.

Recommendations Update Craft CMS to version 5.11.0 or later.