CVE-2026-33157

Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a bypass of a previous fix. The existing patches add cleanseConfig() to assembleLayoutFromPost() and various FieldsController actions to strip Yii2 behavior/event injection keys ("as" and "on" prefixed keys). However, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without any sanitization, enabling the same behavior injection attack chain. This issue has been patched in version 5.9.13.

• CWE-470

• https://github.com/craftcms/cms/commit/97e90b4bdee369c1af3ca77a77531132df240e4ePatch
• https://github.com/craftcms/cms/releases/tag/5.9.13Release Notes
• https://github.com/craftcms/cms/security/advisories/GHSA-2fph-6v5w-89hhExploit, Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33151Socket.IO is an open source, real-time, bidirectional, event…7.5
• CVE-2026-33152Tandoor Recipes is an application for managing recipes, plan…7.5
• CVE-2026-33153Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2026-33154dynaconf is a configuration management tool for Python. Prio…8.1
• CVE-2026-33155DeepDiff is a project focused on Deep Difference and search …7.5
• CVE-2026-33156ScreenToGif is a screen recording tool. In versions from 2.4…7.8
• CVE-2026-33158Craft CMS is a content management system (CMS). From version…6.5
• CVE-2026-33159Craft CMS is a content management system (CMS). From version…6.5
• CVE-2026-33160Craft CMS is a content management system (CMS). From version…5.3
• CVE-2026-33161Craft CMS is a content management system (CMS). From version…4.3
• CVE-2026-33162Craft CMS is a content management system (CMS). From version…6.5
• CVE-2026-33163Parse Server is an open source backend that can be deployed …6.5