CVE-2026-44011 Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
Authenticated attackers can execute arbitrary commands on Craft CMS servers by injecting malicious configuration into field layout data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44011?
CVE-2026-44011 is a high-severity code injection vulnerability in craftcms cms, published on 12 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.
Weakness: CWE-479
Which versions are affected by CVE-2026-44011?
4 open source packages ship an affected version, including craftcms/cms.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.0.0 | 4.17.12 |
craftcms/cms Packagist | From 4.0.0 | 4.17.12 |
craftcms/cms Packagist | From 5.0.0 | 5.9.18 |
craftcms/cms Packagist | From 5.0.0 | 5.9.18 |
How do I fix CVE-2026-44011?
Upgrade craftcms/cms to a fixed version for your release line: 4.17.12 or 5.9.18.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-44011 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44011 exists.
Public exploit code: 6 proofs of concept on GitHub.
Sources
Also known as GHSA-qrgm-p9w5-rrfw.