{"id":"CVE-2026-33157","published":"2026-03-24T17:22:00Z","modified":"2026-03-25T03:56:03Z","title":"Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a bypass of a previous fix. The existing patches add cleanseConfig() to assembleLayoutFromPost() and various FieldsController actions to strip Yii2 behavior/event injection keys (\"as\" and \"on\" prefixed keys). However, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without any sanitization, enabling the same behavior injection attack chain. This issue has been patched in version 5.9.13.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.6,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01114,"percentile":0.659,"provenance":"source"},"cwes":[{"id":"CWE-470","name":"Use of Externally-Controlled Input to Select Classes or Code"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-2fph-6v5w-89hh","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/commit/97e90b4bdee369c1af3ca77a77531132df240e4e","tags":["x_refsource_MISC"]},{"url":"https://github.com/craftcms/cms/releases/tag/5.9.13","tags":["x_refsource_MISC"]}],"priority":{"score":24.2,"factors":[{"name":"EPSS percentile","points":13.18},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.02}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-09-21","earliestUrl":"https://github.com/TRX-0/CVE-2026-33157-craftcms-rce","repos":[{"name":"TRX-0/CVE-2026-33157-craftcms-rce","url":"https://github.com/TRX-0/CVE-2026-33157-craftcms-rce","stars":0,"created":"2026-09-21"}]},"first":{"date":"2026-09-21","source":"PoC-in-GitHub","url":"https://github.com/TRX-0/CVE-2026-33157-craftcms-rce"},"provenance":"source"},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 5.6.0, < 5.9.13"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=5.6.0, <5.9.13"],"patched":["5.9.13"],"from":["GHSA-2fph-6v5w-89hh"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-14934","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-craft-cms-cms-cve-2025-68455","parents":[{"from":"CVE-2025-68455","to":"CVE-2026-33157","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-2fph-6v5w-89hh","via":"reference","url":"https://github.com/advisories/GHSA-255j-qw47-wjh5"}]},{"from":"CVE-2026-25498","to":"CVE-2026-33157","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-2fph-6v5w-89hh","via":"reference","url":"https://github.com/advisories/GHSA-7jx7-3846-m7w7"}]}],"packageHistory":[{"cve":"CVE-2026-32264","published":"2026-03-16","fixed":"5.9.11","kev":false},{"cve":"CVE-2026-33051","published":"2026-03-20","fixed":"5.9.11","kev":false},{"cve":"CVE-2026-32267","published":"2026-03-16","fixed":"5.9.12","kev":false,"link":{"from":"CVE-2026-32267","to":"CVE-2026-33157","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"5.9.12","toFixed":"5.9.13","daysApart":8}]}},{"cve":"CVE-2026-33157","published":"2026-03-24","fixed":"5.9.13","kev":false},{"cve":"CVE-2026-56394","published":"2026-06-21","fixed":"5.9.13","kev":false},{"cve":"CVE-2026-33158","published":"2026-03-24","fixed":"5.9.14","kev":false},{"cve":"CVE-2026-33159","published":"2026-03-24","fixed":"5.9.14","kev":false}],"package":"Packagist:craftcms/cms"}}