CVE-2026-86730: High Code Execution in Craft CMS Before 5.10.12

CVE-2026-86730 is a high severity code injection flaw in Craft CMS 5.0.0-RC1 up to but not including 5.10.12. An authenticated control panel user can slip Yii2 behavior and event handler configuration past a sanitiser, which leads to arbitrary object creation and code execution. The fix is Craft CMS 5.10.12.

What's affected

Affected: craftcms/cms from 5.0.0-RC1 up to but not including 5.10.12. Patched version: 5.10.12. This comes from the Craft CMS GitHub advisory GHSA-qj4v-m29p-fj4m.

Severity differs slightly: the record gives CVSS 3.1 at 8.8 (High), and VulnCheck gives 8.7 on CVSS 4.0, also High. The advisory says any authenticated control panel user can reach the flaw, with no admin role, no special permission and no allowAdminChanges setting needed. Nothing I read reports exploitation, and the CVE is not in CISA KEV.

How to check if you're exposed

Check the installed Craft version with Composer from the project root:

composer show craftcms/cms

The control panel also shows the version in its footer and under Utilities. Anything from 5.0.0-RC1 up to 5.10.11 is affected.

Then list who has control panel access. The advisory's attack needs a signed in control panel account, so every editor, author or contractor with a login counts. Review the list and remove accounts that are no longer needed.

What to do now

1. Run composer show craftcms/cms in every Craft project and note the version.
2. Update to 5.10.12 or later with composer update craftcms/cms, test, and deploy.
3. Audit control panel accounts and remove inactive ones, since the flaw needs a login.
4. Review recent changes to field layouts in project config and your deployment history for anything you did not make.
5. Add Craft to your dependency scan so new advisories surface. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.

Why it matters

The weakness is code injection (CWE-94). Craft cleans configuration that reaches Yii2's object creation, stripping the keys that would attach behaviors or register event handlers. According to the advisory, the cleaning step only walked arrays. When a field layout tab element was submitted as a JSON string, it passed untouched, and was decoded into a live array after the cleaning had run. The dangerous keys then reached Craft::createObject().

The advisory describes this as an incomplete fix for two earlier issues, CVE-2026-33157 and CVE-2026-44011, which put the same cleaning on other paths. That is a common pattern: a sanitiser added at one entry point, and the same data arriving through another.

The impact is code execution in the context of the web application, so the usual precautions apply: patch, limit control panel access, and keep the server account minimal.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Craft CMS GitHub advisory GHSA-qj4v-m29p-fj4m
• VulnCheck advisory
• Safeguard Gold entry for CVE-2026-86730

Last reviewed: 18 October 2026.