CVE-2025-68455

Craft CMS RCE: When 'Magic' Methods Cast a Dark Spell

Alon Barad
Alon Barad
Software Engineer

Jan 5, 2026·6 min read·1 visit

Executive Summary (TL;DR)

Researchers found a way to bypass previous RCE protections in Craft CMS by abusing a built-in Yii2 behavior (`AttributeTypecastBehavior`). Authenticated administrators can inject a malicious configuration array that maps system commands (like `system` or `exec`) to component attributes. When the component saves or renders, the command triggers. The fix involves recursively stripping `as` and `on` keys from configuration arrays.

An authenticated Remote Code Execution (RCE) vulnerability in Craft CMS exploits the underlying Yii2 framework's dynamic component configuration. By leveraging the 'as' and 'on' magic keys in JSON payloads, attackers can attach malicious behaviors to internal components, bypassing previous security filters to execute arbitrary system commands.

Fix Analysis (1)

Technical Appendix

CVSS Score
8.8/ 10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Systems

Craft CMS 5.x < 5.8.21Craft CMS 4.x < 4.16.17

Affected Versions Detail

Product
Affected Versions
Fixed Version
Craft CMS
Pixel & Tonic
< 5.8.215.8.21
Craft CMS
Pixel & Tonic
< 4.16.174.16.17
AttributeDetail
Attack VectorNetwork (Authenticated)
ImpactRemote Code Execution (RCE)
CVSS v3.18.8 (High)
CWE IDCWE-502 (Deserialization of Untrusted Data)
Exploit StatusPoC Available / Weaponized
FrameworkYii2
CWE-502
Deserialization of Untrusted Data

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Vulnerability Timeline

Vulnerability discovered by researchers
2025-11-01
Patch commits pushed to GitHub
2025-11-20
Public release of Craft CMS 5.8.21
2025-12-01

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.