# Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior

Unsanitized fieldLayouts param in Craft CMS ElementIndexesController::actionFilterHud lets any control-panel user inject Yii2 behavior keys to achieve RCE.

- Payout: Research
- Severity: high
- Program: Craft CMS
- Found by: yuma4869
- Disclosed: 2026-03-24
- CVE: CVE-2026-33157
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-2fph-6v5w-89hh
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-2fph-6v5w-89hh
- Tags: area:web domain:web impact:rce kind:research platform:ghsa sev:high tech:php technique:incomplete-fix technique:source-review vuln:deserialization vuln:misconfiguration vuln:rce

**Target:** ElementIndexesController::actionFilterHud fieldLayouts parameter
**Root cause:** fieldLayouts body param is passed to FieldLayout::createFromConfig() without Component::cleanseConfig(), unlike conditionConfig, so Yii2 'as ' and 'on ' prefixed keys reach App::configure and inject behaviors/event handlers.
**Steps:**
1. Authenticate with accessCp permission and POST to the element index filter HUD endpoint with a `fieldLayouts` array.
2. Include a config key `as rce` whose value instantiates `AttributeTypecastBehavior` with a command string property.
3. Include an `on *` wildcard event handler key.
4. FieldLayout::createFromConfig -> new self($config) -> Model::__construct -> App::configure processes keys.
5. `as rce` -> Component::__set -> Yii::createObject attaches AttributeTypecastBehavior; `on *` registers wildcard handler.
6. init() -> setTabs([]) -> getAvailableNativeFields() triggers EVENT_DEFINE_NATIVE_FIELDS, firing the wildcard handler.
7. AttributeTypecastBehavior::beforeSave -> typecastAttributes -> owner->typecastBeforeSave resolves to command string -> call_user_func([ConsoleProcessus::class,'execute'], $command) -> shell_exec.
**How found:** Noticed cleanseConfig() was applied to conditionConfig but not to fieldLayouts in the same action, then traced the unsanitized config through createFromConfig into Yii2 behavior/event injection.
**Exploitation:** Any authenticated control-panel user posts a crafted fieldLayouts array; behavior injection attaches AttributeTypecastBehavior and a wildcard event handler, which on init triggers typecast and executes the attacker-supplied command via ConsoleProcessus::execute/shell_exec.
**Escalation:** Bypasses prior fixes GHSA-7jx7-3846-m7w7 and GHSA-255j-qw47-wjh5 that added cleanseConfig() elsewhere, reusing the same behavior-injection chain on an unpatched sink.
**Insight:** When a patch adds cleanseConfig() to some params, grep every other param flowing into createFromConfig/App::configure in the same controller; inconsistent sanitization is the bypass. Wildcard `on *` handlers plus behaviors whose callbacks resolve to attacker-controlled properties give a clean RCE primitive.