CVE-2026-33157: Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
(updated )
A Remote Code Execution (RCE) vulnerability exists in Craft CMS 5.x and 4.x that bypasses the security fixes for GHSA-7jx7-3846-m7w7 and GHSA-255j-qw47-wjh5. This vulnerability can be exploited by any authenticated user with control panel access.
The existing patches add cleanseConfig() to assembleLayoutFromPost() and various FieldsController actions to strip Yii2 behavior/event injection keys (as and on prefixed keys). However, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without any sanitization, enabling the same behavior injection attack chain.
References
- github.com/advisories/GHSA-255j-qw47-wjh5
- github.com/advisories/GHSA-2fph-6v5w-89hh
- github.com/advisories/GHSA-7jx7-3846-m7w7
- github.com/craftcms/cms
- github.com/craftcms/cms/commit/97e90b4bdee369c1af3ca77a77531132df240e4e
- github.com/craftcms/cms/releases/tag/5.9.13
- github.com/craftcms/cms/security/advisories/GHSA-2fph-6v5w-89hh
- nvd.nist.gov/vuln/detail/CVE-2026-33157
Code Behaviors & Features
Detect and mitigate CVE-2026-33157 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →