CVE-2025-68455: 
PHP vulnerability analysis and mitigation

CVE-2025-68455 is an authenticated Remote Code Execution (RCE) vulnerability in Craft CMS, caused by unsafe reflection via maliciously attached Yii Behavior classes. It affects Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16. The vulnerability was disclosed on January 3, 2026, and patched versions (5.8.21 and 4.16.17) were released shortly after. It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 8.6 (High), requiring administrator-level access to exploit (GitHub Advisory).

The vulnerability is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code — 'Unsafe Reflection'). It is inspired by CVE-2024-4990 and CVE-2024-58136 but bypasses their mitigations by leveraging the legitimate yii\behaviors\AttributeTypecastBehavior class. Using the as syntax in JSON POST input, an attacker can attach this Behavior to a Yii Component and define an arbitrary PHP callable (e.g., Psy\Readline\Hoa\ConsoleProcessus::execute) that is triggered when any event fires on the tainted Component via a wildcard on * event listener. Two vulnerable routes were identified in FieldsController.php: /index.php?p=admin/actions/fields/apply-layout-element-settings and /index.php?p=admin/actions/fields/render-card-preview. The fix applied Component::cleanseConfig() to sanitize user-supplied configuration arrays before processing (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated administrator to execute arbitrary PHP code on the backend server, resulting in full compromise of confidentiality, integrity, and availability. An attacker can run arbitrary OS commands, read or exfiltrate sensitive data, modify application files, or establish persistent access (e.g., web shells). While the attack surface is limited to users with Craft Control Panel administrator access — reducing the risk of external exploitation — insider threats or compromised admin accounts represent a realistic attack path (GitHub Advisory).

A proof-of-concept (PoC) exploit with full HTTP request payloads is publicly available in the GitHub Security Advisory. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.57%, reflecting low but non-negligible exploitation probability. No specific threat actor attribution has been reported (GitHub Advisory).

1. Obtain Administrator Access: Gain valid Craft CMS administrator credentials, either through credential theft, phishing, or insider access to the Control Panel.
2. Authenticate and Retrieve CSRF Token: Log into the Craft Control Panel and capture a valid session cookie (CraftSessionId) and CSRF token (X-CSRF-Token) from an authenticated browser session.
3. Craft Malicious JSON Payload: Construct a JSON body containing the as xxx key with __class set to yii\behaviors\AttributeTypecastBehavior, defining an attacker-controlled callable (e.g., ["Psy\\Readline\\Hoa\\ConsoleProcessus", "execute"]) and the desired OS command as the typecastBeforeSave argument. Include "on *": "self::beforeSave" to trigger the callable on any event.
4. Send POST Request to Vulnerable Endpoint: Submit the crafted payload via an authenticated HTTP POST request to either /index.php?p=admin/actions/fields/apply-layout-element-settings or /index.php?p=admin/actions/fields/render-card-preview, including the valid session and CSRF headers.
5. Achieve Code Execution: The server processes the malicious Behavior, fires an event on the tainted Component, and executes the attacker-defined callable with the supplied argument, resulting in arbitrary OS command execution on the server (GitHub Advisory).

• Network: Unusual authenticated POST requests to /index.php?p=admin/actions/fields/apply-layout-element-settings or /index.php?p=admin/actions/fields/render-card-preview with JSON bodies containing as xxx, __class, AttributeTypecastBehavior, or ConsoleProcessus strings.
• Logs: Web server access logs showing POST requests to the above admin endpoints with large or anomalous JSON payloads; PHP error logs referencing AttributeTypecastBehavior or unexpected callable invocations.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the web server process; new or modified PHP files in the Craft CMS installation directory that could indicate web shell deployment.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., sh, bash, curl, wget, python) executing OS commands not typical of normal CMS operation (GitHub Advisory).

Craft CMS has released patched versions addressing this vulnerability: 5.8.21 for the 5.x branch and 4.16.17 for the 4.x branch. The fix applies Component::cleanseConfig() to sanitize user-supplied configuration arrays in FieldsController.php before they are processed, preventing malicious Behavior attachment. No configuration-based workaround is available; upgrading to the patched version is the only reliable remediation. Additionally, organizations should restrict Craft Control Panel administrator access to trusted users only and enforce the principle of least privilege for admin account assignments (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher 'chutchut' and published via GitHub Security Advisory on January 3, 2026. The advisory notes that the underlying issue was originally reported to the Yii framework team (as a vulnerability in Yii2, related to GHSA-gcmh-9pjj-7fp4), but the Yii team declined to fix it at the framework level, placing responsibility on application developers. Craft CMS maintainer Brandon Kelly committed the fix directly. The vulnerability received coverage from threat intelligence aggregators including Vulners, CIRCL Vulnerability Lookup, and security news outlets (GitHub Advisory).