CVE-2026-25498

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25498
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25498.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25498
Aliases
Downstream
Published
2026-02-09T19:55:06Z
Modified
2026-08-12T03:51:35Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
Details

Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution (RCE) vulnerability exists in Craft CMS where the assembleLayoutFromPost() function in src/services/Fields.php fails to sanitize user-supplied configuration data before passing it to Craft::createObject(). This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455, affecting different endpoints through a separate code path. This vulnerability is fixed in 5.8.22.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-470"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25498.json"
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
04755d93f86d07cc183db47db8a0eee106892e30
Fixed
8e23a7a14d50f169c10a487348c993384d479e06
Introduced
daac7c1da2f701f2e9ddee1da1457ce61660b581
Fixed
fc466946af3dd7928f5fd0e26099b9dc0eb2ce72
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "5.0.0-RC1"
        },
        {
            "fixed": "5.8.22"
        },
        {
            "introduced": "4.0.0-RC1"
        },
        {
            "fixed": "4.16.18"
        }
    ],
    "source": "AFFECTED_FIELD"
}
Type
GIT
Repo
https://github.com/nystudio107/craft-seomatic
Events
Introduced
a31f7d211b52d55d274c66a291310ceec64c733f
Last Affected
a31f7d211b52d55d274c66a291310ceec64c733f
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.0-NA"
        },
        {
            "last_affected": "4.0.0-NA"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

4.*
4.0.0
4.0.0-NA
4.0.0-rc1
4.0.0-rc2
4.0.0-rc3
5.*
5.0.0-NA
5.0.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25498.json"