Is CVE-2026-112774 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112774?

CVE-2026-112774 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-112774

Description

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.