CVE-2026-112774 | Craft CMS up to 5.10.x ContentBlock setFieldLayout field layout os command injection

October 19, 2026 Yanac

A vulnerability marked as problematic has been reported in Craft CMS up to 5.10.x. The impacted element is the function ContentBlock::setFieldLayout of the component ContentBlock. Performing a manipulation of the argument field layout results in os command injection.

This vulnerability is reported as CVE-2026-112774. The attack is possible to be carried out remotely. No exploit exists.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More