CVE-2026-86730

CVE-2026-86730 is a code-injection flaw (CWE-94) in Craft CMS versions before 5.10.12 caused by improper cleansing of string-typed field-layout elements. An authenticated control-panel user can submit field-layout tab elements as JSON strings to bypass cleanse validation, which allows attaching arbitrary Yii2 behaviors and event handlers and reaching arbitrary object instantiation via Craft::createObject(), resulting in code execution. An attacker with even a low-privilege control-panel account can therefore achieve high-impact compromise of confidentiality, integrity, and availability on the server (CVSS 4.0: 8.7). Any Craft CMS deployment running an affected version is exposed, with risk concentrated on sites that grant control-panel access to editors, clients, or other third parties. There is no public proof-of-concept, no CISA KEV listing, and no known exploitation; EPSS estimates a 0.4% probability of exploitation within 30 days.

What to do: Upgrade all Craft CMS 5.x installations to 5.10.12 or later. Until patched, limit control-panel access to trusted users and review field layouts for tab elements posted as JSON strings. Monitor logs for anomalous field-layout modifications and unexpected Craft::createObject() class instantiation, since exploitation requires an authenticated CP session.