CVE-2026-33157
Published: 24 March 2026
Summary
CVE-2026-33157 is a high-severity Unsafe Reflection (CWE-470) vulnerability in Craftcms Craft Cms. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely flaw remediation, directly addressing this CVE by applying the vendor patch in Craft CMS version 5.9.13 that sanitizes the fieldLayouts parameter.
SI-10 mandates validation of all inputs, preventing the Yii2 behavior/event injection attack by sanitizing the unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud().
AC-6 enforces least privilege, reducing the attack surface by limiting control panel access to only necessary authenticated users required for this high-privilege (PR:H) RCE exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE in public-facing Craft CMS web app directly maps to T1190 for initial exploitation; arbitrary server-side code execution enables web shell deployment (T1505.003).
NVD Description
Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a…
more
bypass of a previous fix. The existing patches add cleanseConfig() to assembleLayoutFromPost() and various FieldsController actions to strip Yii2 behavior/event injection keys ("as" and "on" prefixed keys). However, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without any sanitization, enabling the same behavior injection attack chain. This issue has been patched in version 5.9.13.
Deeper analysisAI
CVE-2026-33157 is a Remote Code Execution (RCE) vulnerability in Craft CMS, a content management system, affecting versions from 5.6.0 to before 5.9.13. The issue stems from a bypass of prior mitigations against Yii2 behavior and event injection attacks using "as" and "on" prefixed keys. Specifically, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without sanitization via cleanseConfig(), unlike fixes applied to assembleLayoutFromPost() and FieldsController actions. It is classified under CWE-470 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Any authenticated user with control panel access can exploit this vulnerability remotely with low complexity and no user interaction required. Exploitation enables arbitrary code execution on the server, potentially leading to full compromise with high impacts on confidentiality, integrity, and availability.
Craft CMS has patched the vulnerability in version 5.9.13. Security practitioners should upgrade immediately. Key references include the fixing commit at https://github.com/craftcms/cms/commit/97e90b4bdee369c1af3ca77a77531132df240e4e, release notes at https://github.com/craftcms/cms/releases/tag/5.9.13, and the GitHub security advisory at https://github.com/craftcms/cms/security/advisories/GHSA-2fph-6v5w-89hh.
Details
- CWE(s)