CVE-2026-25498: 
PHP vulnerability analysis and mitigation

CVE-2026-25498 is a Remote Code Execution (RCE) vulnerability in Craft CMS affecting versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The flaw exists in the assembleLayoutFromPost() function in src/services/Fields.php, which fails to sanitize user-supplied configuration data before passing it to Craft::createObject(), enabling authenticated administrators to inject malicious Yii2 behavior configurations and execute arbitrary system commands. It was disclosed and published on February 9, 2026, and represents an unpatched variant of the behavior injection vulnerability addressed in CVE-2025-68455 (GHSA-255j-qw47-wjh5), affecting different endpoints through a separate code path. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / Unsafe Reflection). The assembleLayoutFromPost() function decodes a user-supplied fieldLayout JSON POST parameter and passes it directly to createLayout(), which calls Craft::createObject() without first invoking ComponentHelper::cleanseConfig() to strip dangerous keys. An attacker exploits Yii2's object configuration system by including an 'as rce' key in the POST payload, which triggers Component::__set() to attach a malicious AttributeTypecastBehavior; when validate() is called on the resulting model, EVENT_AFTER_VALIDATE fires and the behavior executes an arbitrary shell command via call_user_func(['Psy\Readline\Hoa\ConsoleProcessus', 'execute'], $command). The fix, applied in commit 395c64f, adds a single ComponentHelper::cleanseConfig() call to sanitize the decoded config before use. Multiple admin controllers are affected, including TagsController, CategoriesController, EntryTypesController, GlobalsController, VolumesController, UsersController, and AddressesController (GitHub Advisory, Patch Commit).

Successful exploitation grants an authenticated administrator the ability to execute arbitrary operating system commands on the server with the privileges of the web server process, resulting in full confidentiality, integrity, and availability compromise of the affected system. This can lead to unauthorized data access and exfiltration, installation of backdoors or malware, and disruption of service availability. The attacker can also leverage the compromised server as a pivot point for lateral movement to other systems on the internal network (GitHub Advisory, Feedly).

A proof-of-concept exploit is referenced in the GitHub security advisory (GHSA-7jx7-3846-m7w7), though no evidence of active in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires valid administrator credentials, which limits the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.163% (0.315% per the GitHub Advisory), placing it in the 55th percentile for exploitation likelihood within 30 days. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Craft CMS instances running versions 4.0.0-RC1 through 4.16.17 or 5.0.0-RC1 through 5.8.21 with an accessible admin panel (/admin). Tools like Shodan or Censys can be used to locate internet-facing instances.
2. Obtain Admin Credentials: Acquire valid administrator credentials through phishing, credential stuffing, or other means, as admin-level access is required.
3. Authenticate: Log in to the Craft CMS admin panel at /admin using the obtained credentials.
4. Craft Malicious Payload: Construct a JSON payload for the fieldLayout POST parameter that includes an 'as rce' key containing a malicious AttributeTypecastBehavior configuration. For example:

{
  "as rce": {
    "class": "yii\\behaviors\\AttributeTypecastBehavior",
    "typecastAfterValidate": true,
    "attributeTypes": {
      "uid": ["Psy\\Readline\\Hoa\\ConsoleProcessus", "execute"]
    }
  },
  "uid": "<COMMAND_TO_EXECUTE>"
}

5. Submit to Vulnerable Endpoint: Send an authenticated POST request to one of the affected controller actions (e.g., actionSaveTagGroup, actionSave for entry types, volumes, globals, etc.) with the crafted fieldLayout parameter.
6. Trigger RCE: When the server processes the request, assembleLayoutFromPost() passes the unsanitized config to Craft::createObject(), Yii2 attaches the malicious behavior, and validate() triggers EVENT_AFTER_VALIDATE, causing ConsoleProcessus::execute() to run the injected command.
7. Achieve Objective: The command executes with web server process privileges, enabling reverse shell establishment, data exfiltration, or further persistence (GitHub Advisory, Patch Commit).

• Network: Unusual outbound connections from the web server process to external IPs (potential reverse shell callbacks); unexpected DNS lookups from the Craft CMS server.
• Logs: Craft CMS access logs showing authenticated POST requests to admin controller actions (e.g., /index.php?p=admin/actions/tags/save-tag-group, /index.php?p=admin/actions/entry-types/save, /index.php?p=admin/actions/globals/save-set) with large or anomalous fieldLayout body parameters containing 'as '-prefixed keys.
• File System: Unexpected new files (web shells, scripts) in the Craft CMS installation directory or web root; new cron jobs or scheduled tasks created by the web server user.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., /bin/bash, curl, wget, python, nc); unexpected process execution chains originating from the web server user account.

Craft CMS has released patched versions addressing this vulnerability: 5.8.22 for the 5.x branch and 4.16.18 for the 4.x branch. The fix adds a ComponentHelper::cleanseConfig() call in assembleLayoutFromPost() to sanitize user-supplied configuration data before it is passed to Craft::createObject(). Organizations unable to upgrade immediately should restrict administrative panel access to trusted personnel only, implement network-level controls to limit access to the /admin endpoint, and monitor server logs for suspicious POST requests to affected controller actions (GitHub Advisory, Release 5.8.22, Patch Commit).

The vulnerability was reported by security researchers RajChowdhury240 and rlarabee and published by Craft CMS maintainer angrybrad via the GitHub Security Advisory program on February 9, 2026. The advisory explicitly contextualizes this as a bypass of the previously patched GHSA-255j-qw47-wjh5, highlighting that the original fix did not cover all vulnerable code paths. No significant broader media coverage or notable social media commentary has been identified beyond the technical advisory (GitHub Advisory).