Cloudanix VulnDB

CVE-2025-68455

High · 7.2

Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

CVSS

7.2

EPSS

1.0%

Published

Jan 5, 2026

CISA due date

—

The record

This was reported as a vulnerability in Yii framework on August 7th (https://github.com/yiisoft/yii2/security/advisories/GHSA-gcmh-9pjj-7fp4). The Yii framework team denies responsibility for this (placing the onus on application developers) and hence has not (and seemingly will not) provide a fix at the framework level. Hence, I am reporting this to Craft as I found it to affect the latest (`5.6.0`) version of Craft CMS. Leveraging a legitimate but maliciously crafted Yii `Behavior` class, it’s possible to trigger Remote Code Execution (RCE) via Reflection when the tainted `Behavior` is attached to a Yii `Component`, and an event is also fired on the tainted `Component`.

Affected packages

Ecosystem Package Introduced Fixed
Packagist craftcms/cms 4.0.0-RC1 4.16.17
Packagist craftcms/cms 5.0.0-RC1 5.8.21
packagist craftcms/cms 4.0.0-RC1 4.16.17
packagist craftcms/cms 5.0.0-RC1 5.8.21

Related vulnerabilities