Is CVE-2026-86730 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86730?

CVE-2026-86730 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-86730

Description

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().