Advisory · CVE-2026-112774
Craft CMS ContentBlock field layout JSON lets administrators bypass config cleansing for code execution
Craft CMS 5.8.0 before 5.11.0 JSON-decodes ContentBlock field layouts after cleanseConfig runs, so authenticated administrators with allowAdminChanges enabled can smuggle as or on keys into Craft::createObject and execute OS commands as the web user. CVSS 4.0 8.7 (CVSS 3.1 7.2).
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-112774
CWE-94 - Action timing
- Immediate
Explain it like I’m five
The layout is washed while it is still encoded text and only then unpacked, so the dangerous keys arrive after the checkpoint and are never inspected.
- 01Admin access held
An authenticated administrator works on a site with allowAdminChanges enabled.
- 02JSON layout supplied
The attacker submits a ContentBlock field layout as a JSON string carrying top-level as or on keys.
- 03Cleanse runs too early
cleanseConfig sanitizes the encoded string; the JSON is decoded afterwards and passed to createLayout without a second cleanse.
- 04Commands execute
Craft::createObject honours the keys during hydration, giving OS command execution and secret disclosure as the web user.
What happened
Craft CMS disclosed CVE-2026-112774 (CWE-94) for versions 5.8.0 before 5.11.0: ContentBlock::setFieldLayout() accepts a string field-layout config, JSON-decodes it after the cleanseConfig sanitization boundary, and passes the result to Fields::createLayout(), which calls Craft::createObject with no re-cleanse, so surviving as or on keys are honoured during object hydration.
The vendor advisory requires an authenticated administrator and allowAdminChanges enabled. Per the vendor affected data in the NVD record, 5.11.0 is the first unaffected release.
What to do
- Inventory Craft CMS sites and note whether each runs the 4.x or 5.x line.
- Upgrade affected sites to 5.11.0 or later using the project release guidance.
- Restrict Control Panel access to trusted networks and named administrators while remediation is underway.
- Hunt for ContentBlock field layout changes by administrators, especially JSON-string layouts, and OS commands or secret reads attributable to the web user.
- Verify the deployed version after updating, not just that an update ran.
Management note
Administrator-to-code-execution still matters: it breaks the assumption that a compromised or malicious admin account stops at content. Keep allowAdminChanges off in production where you can, and patch regardless.