CVE-2026-33157: 
PHP vulnerability analysis and mitigation

CVE-2026-33157 is an authenticated Remote Code Execution (RCE) vulnerability in Craft CMS that bypasses prior security fixes for GHSA-7jx7-3846-m7w7 and GHSA-255j-qw47-wjh5. It affects Craft CMS versions 5.6.0 through 5.9.12 and can be exploited by any authenticated user with control panel (accessCp) access. The vulnerability was disclosed on March 24, 2026, and patched in version 5.9.13. It carries a CVSS v3.1 score of 7.2 (High) and a CVSS v4.0 score of 8.6 (High) (GitHub Advisory).

The root cause is an unsafe reflection vulnerability (CWE-470) in ElementIndexesController::actionFilterHud(), where the fieldLayouts body parameter is passed directly to FieldLayout::createFromConfig() without first calling Component::cleanseConfig() to strip Yii2 behavior/event injection keys. This is inconsistent with how conditionConfig is handled in the same function, which is properly sanitized. An attacker can craft a fieldLayouts array containing config entries with "as <name>" prefixed keys to inject a malicious AttributeTypecastBehavior and "on *" wildcard event handlers, triggering the Yii2 behavior attachment mechanism and ultimately executing arbitrary shell commands via call_user_func([ConsoleProcessus::class, 'execute'], $command). This is a bypass of patches previously applied to assembleLayoutFromPost() and various FieldsController actions (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated control panel user to execute arbitrary operating system commands on the server with the privileges of the web application process, resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker could exfiltrate sensitive data (database credentials, environment variables, user data), modify or destroy application files, install backdoors, or pivot to other internal systems. The scope is limited to the vulnerable system itself (no subsequent system impact per CVSS v4.0), but the web server process context typically provides broad access to application data and configuration (GitHub Advisory).

A proof-of-concept exploit chain is publicly documented in the GitHub Security Advisory, detailing the exact vulnerable endpoint (ElementIndexesController::actionFilterHud), the parameter name (fieldLayouts), and the payload structure required to achieve RCE. The EPSS score is approximately 0.043%, indicating low current exploitation probability. As of the time of disclosure, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session with control panel access, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Obtain Control Panel Access: Acquire valid credentials for a Craft CMS account with accessCp permission (any control panel user, not necessarily an administrator).
2. Authenticate and Retrieve CSRF Token: Log in to the Craft CMS control panel and capture a valid X-CSRF-Token and session cookies from the browser or via a login request.
3. Craft the Malicious Payload: Construct a JSON fieldLayouts array containing a config object with an "as rce" prefixed key that specifies yii\behaviors\AttributeTypecastBehavior as the class, sets typecastBeforeSave to a target command (e.g., "id > /tmp/pwned"), and includes an "on *": "self::beforeSave" wildcard event handler.
4. Send the Request: POST the crafted payload to the ElementIndexesController::actionFilterHud() endpoint (e.g., /index.php?p=admin/actions/element-indexes/filter-hud) with appropriate Content-Type: application/json, X-CSRF-Token, and session cookie headers.
5. Trigger the Attack Chain: The unsanitized fieldLayouts parameter is passed to FieldLayout::createFromConfig(), which calls Model::__construct() → App::configure() → Component::__set("as rce", ...) → Yii::createObject(), attaching the AttributeTypecastBehavior. The "on *" handler fires on any event, calling beforeSave() → typecastAttributes() → call_user_func([ConsoleProcessus::class, 'execute'], $command) → shell_exec($command).
6. Confirm Code Execution: Verify the command executed on the server (e.g., check for created files, out-of-band DNS/HTTP callbacks, or review server-side artifacts) (GitHub Advisory).

• Network: Unusual POST requests to the element-indexes/filter-hud action endpoint containing JSON bodies with "as " or "on " prefixed keys in the fieldLayouts parameter; unexpected outbound connections (reverse shells, DNS lookups) from the web server process.
• Logs: Craft CMS access logs showing POST requests to /actions/element-indexes/filter-hud with large or anomalous JSON payloads; PHP error logs referencing AttributeTypecastBehavior, ConsoleProcessus, or shell_exec in unexpected contexts.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the web server user; new web shells or scripts in the Craft CMS web root or storage directories; modified files with timestamps inconsistent with normal deployments.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., sh, bash, curl, wget, python, nc) visible in process listings (GitHub Advisory).

The primary remediation is to upgrade Craft CMS to version 5.9.13 or later, which applies Component::cleanseConfig() to the fieldLayouts parameter in ElementIndexesController::actionFilterHud() before passing it to FieldLayout::createFromConfig(). The fix was merged in commit 97e90b4. If immediate patching is not possible, restrict control panel access to the minimum necessary set of trusted users and monitor for suspicious POST requests to the element-indexes/filter-hud endpoint. Web application firewall (WAF) rules blocking JSON payloads containing "as " or "on " prefixed keys in request bodies targeting Craft CMS admin endpoints may provide partial mitigation (Patch Commit, Release Notes).

The vulnerability was reported by researcher yuma4869 and published by angrybrad on March 24, 2026. It is part of a recurring pattern of Yii2 behavior injection bypasses in Craft CMS, following GHSA-255j-qw47-wjh5 (CVE-2025-68455) and GHSA-7jx7-3846-m7w7 (CVE-2026-25498), which addressed similar attack chains in different code paths. The Craft CMS team acknowledged the issue as high-severity and released a patch the same day as disclosure. Community discussion noted the persistent challenge of comprehensively sanitizing all code paths that pass user-supplied config to Yii2's object creation system (GitHub Advisory).