CVE-2026-25498CWE-470

Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

High · published February 9, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
70.9
In the wild
Unconfirmed
What it is

Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01332 · 70.9th percentile
Weakness
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2026-02-09T19:55Z
EPSS history
Timeline
  • 09 FEB 19:55Z
    Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
    cvelistv5