CVE-2026-25498 Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
Authenticated administrators can execute arbitrary system commands by injecting malicious Yii2 behavior configurations into Craft CMS fields.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25498?
CVE-2026-25498 is a high-severity code injection vulnerability in Craftcms Craft Cms, published on 9 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22.
Weakness: CWE-470
Which versions are affected by CVE-2026-25498?
4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.0.0-RC1 | 4.16.18 |
craftcms/cms Packagist | From 4.0.0-RC1 | 4.16.18 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.8.22 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.8.22 |
Products include Craftcms Craft Cms.
How do I fix CVE-2026-25498?
Upgrade craftcms/cms to a fixed version for your release line: 4.16.18 or 5.8.22.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-25498 being exploited?
There is no known exploitation of CVE-2026-25498 in the wild and no public exploit code.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-7jx7-3846-m7w7.