# Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Authenticated admin can attach a crafted Yii AttributeTypecastBehavior via JSON 'as' key and wildcard event to invoke an arbitrary PHP callable, achieving RCE in Craft CMS.

- Payout: Research
- Severity: high
- Program: Craft CMS
- Found by: chutchut
- Disclosed: 2026-01-05
- CVE: CVE-2025-68455
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-255j-qw47-wjh5
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-255j-qw47-wjh5
- Tags: area:web domain:web impact:privesc impact:rce kind:research platform:ghsa sev:high tech:php technique:incomplete-fix technique:source-review vuln:deserialization vuln:misconfiguration vuln:rce

**Target:** Craft CMS admin JSON action endpoints (fields/apply-layout-element-settings, fields/render-card-preview)
**Root cause:** Yii's 'as <behavior>' JSON syntax lets an attacker attach a legitimate AttributeTypecastBehavior whose typecastBeforeSave is an arbitrary callable; a wildcard 'on *' listener routes any fired event to self::beforeSave, invoking the attacker callable. This bypasses the Behavior-type-only restriction added for CVE-2024-4990/CVE-2024-58136.
**Steps:**
1. Install Craft CMS via `composer create-project "craftcms/craft" app` and run `./craft serve 127.0.0.1:9090`.
2. Authenticate as admin and obtain CSRF token.
3. POST JSON to `/index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings` with body containing `"as xxx": {"__class": "yii\\behaviors\\AttributeTypecastBehavior", "__construct()": [{"attributeTypes": {"typecastBeforeSave": ["Psy\\Readline\\Hoa\\ConsoleProcessus", "execute"]}, "typecastBeforeSave": "touch /tmp/touch111"}]}` and `"on *": "self::beforeSave"`.
4. Alternatively POST to `/index.php?p=admin%2Factions%2Ffields%2Frender-card-preview` with `fieldLayoutConfig` containing the same payload.
5. Confirm RCE via `ls -la /tmp/` showing touch111/touch222.
**How found:** Inspired by CVE-2024-4990; researcher noted Yii denied the framework-level issue and tested Craft 5.6.0. Recognized that the Behavior-type-only fix could be bypassed using a legitimate Behavior (AttributeTypecastBehavior) whose magic __set/__get and beforeSave invoke an attacker-controlled callable, then combined with a wildcard 'on *' event listener to force invocation.
**Exploitation:** Admin sends a JSON POST to a vulnerable admin action; the config object is hydrated by Yii, attaching AttributeTypecastBehavior with attacker-controlled callable and argument, and the wildcard event listener triggers beforeSave, executing the callable (e.g. ConsoleProcessus::execute) on the server.
**Insight:** When a framework restricts deserialization to a class hierarchy (e.g. Behavior), audit every legitimate subclass for magic methods or lifecycle hooks (beforeSave, __set/__get) that accept callables or class names; a wildcard event listener ('on *') can force those hooks to fire on demand, turning a benign type into a gadget.