CVE-2026-78416: Authenticated RCE via `condition.config` JSON cleanse bypass
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.18.2 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to the Craft CMS control panel and able to reach element-search condition handling. Successful exploitation executes commands as the PHP or web-server user.
Which releases need to be updated?
Affected releases are Craft CMS 4 starting at 4.0.0-RC1 and earlier than 4.18.2, and Craft CMS 5 starting at 5.0.0-RC1 and earlier than 5.10.6. Update to 4.18.2 or 5.10.6, respectively.
What capability enables code execution?
The issue is triggered through the condition.config JSON handling used by control panel element-search conditions. A JSON cleanse bypass allows Yii behavior or event configuration keys to be interpreted after decoding.