{"schema":"threatline.record/2","record":{"id":"GHSA-j6r9-fxgv-j7x5","aliases":["GHSA-j6r9-fxgv-j7x5"],"summary":"Authenticated admin RCE via Content Block field-layout JSON-string cleanse","details":"This requires `allowAdminChanges` to be enabled, which is against [security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production).\r\n\r\n`craft\\fields\\ContentBlock::setFieldLayout()` accepts a `string` field-layout config, JSON-decodes it after the `Component::cleanseConfig()` sanitization boundary, and passes the result to `Fields::createLayout()`, which calls `Craft::createObject()` with no re-cleanse. A surviving top-level `as X` / `on X` key (a Yii behavior/event gadget) is therefore honored during object hydration, attaching an attacker-controlled behavior/event handler to the `FieldLayout` — the same terminal gadget abused by GHSA-265m-7826-wjqm — yielding authenticated admin remote code execution as the web user.\r\n\r\nThis is a distinct, unpatched caller of the object-config → behavior-injection RCE family.\r\n\r\nCraft has patched this family caller-by-caller (`Conditions::createCondition`, `assembleLayoutFromPost` for GHSA-7jx7-3846-m7w7; `ElementIndexesController` for GHSA-2fph-6v5w-89hh; `element-index/search` for `GHSA-qrgm-p9w5-rrfw`) and never converted `createLayout()` to cleanse internally, leaving `ContentBlock::setFieldLayout` untouched.\r\n\r\n### Impact\r\nAuthenticated admin (with `allowAdminChanges = true`, the default) achieves OS command execution as the web/PHP user, plus secret/environment disclosure — identical terminal impact to GHSA-265m-7826-wjqm and GHSA-7jx7-3846-m7w7.\r\n\r\nReport ID: 1716","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-j6r9-fxgv-j7x5","source_modified_at":"2026-10-05T17:43:33Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.8.0, < 5.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-j6r9-fxgv-j7x5","source_modified_at":"2026-10-05T17:43:33Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.0"}],"cvss":null,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:43:33Z","modified_at":"2026-10-05T17:43:33Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-j6r9-fxgv-j7x5","fetched_at":"2026-10-25T21:40:15.971031Z","source_modified_at":"2026-10-05T17:43:33Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T17:43:33Z","content_hash":"b7157cd06eeea661f9a5bf6730392fb3e124161b35fc9578ba16623ec7a2cdb0"}}