CVE-2026-72778 in Craft CMS
Summary
by MITRE • 08/11/2026
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as 'as ...' and 'on ...' can be hidden inside it and, after JSON decoding, are interpreted by Yii as behavior/event configuration during FieldLayout object creation. An attacker with an authenticated control panel session (and a valid CSRF token) can exploit this to execute operating system commands as the PHP/web user.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within Craft CMS versions prior to 4.18.2 and 5.10.6, specifically targeting the control panel's element-search condition handling functionality. The flaw stems from an improper sanitization process that occurs during request processing, creating a path for authenticated remote code execution. When a user submits a search query through the control panel interface, the system attempts to sanitize the incoming configuration data using Component::cleanseConfig() which properly handles the outer request-controlled condition array. However, the vulnerability emerges in the subsequent Conditions::createCondition() method where the JSON string contained within condition.config undergoes decoding and merging without re-applying the cleansing process.
The technical implementation of this vulnerability leverages Yii framework's special configuration keys such as 'as ...' and 'on ...' which are typically used for defining behaviors and event handlers within the framework. These keys can be embedded within the JSON string structure and remain hidden from the initial cleansing operation since they exist at a nested level. After the JSON decoding process, these special Yii configuration keys are interpreted by the framework during FieldLayout object creation, effectively allowing attackers to inject malicious behavior definitions that execute arbitrary operating system commands with the privileges of the PHP/web user account.
The operational impact of this vulnerability is significant as it requires only an authenticated control panel session along with a valid CSRF token for exploitation. This means that any user with access to the Craft CMS control panel can potentially leverage this flaw to execute arbitrary code on the server, potentially leading to full system compromise. The vulnerability affects both version 4.x and 5.x branches of Craft CMS, indicating it is a fundamental issue in the core configuration handling mechanism. According to CWE standards, this represents a weakness in input validation that allows for code injection through improper sanitization of framework-specific configuration keys.
The attack vector specifically targets the element-search functionality within the control panel, where users can construct complex queries using various conditions. The exploitation process involves crafting a malicious JSON payload containing special Yii keys that, when processed, trigger the execution of operating system commands. This type of vulnerability aligns with ATT&CK technique T1059.001 for command and scripting interpreter usage, as it enables adversaries to execute shell commands through the PHP environment. The vulnerability demonstrates poor defense-in-depth practices where input sanitization is applied at only one level of processing rather than maintaining consistent security controls throughout the entire data pipeline.
The recommended mitigations include updating to the patched versions 4.18.2 and 5.10.6 which implement proper re-application of cleansing operations after JSON decoding, ensuring that all configuration keys are properly sanitized regardless of their nesting level within the data structure. Organizations should also consider implementing additional access controls and monitoring for unusual command execution patterns within their Craft CMS environments. The fix addresses the root cause by ensuring that the cleanseConfig() function is applied consistently throughout the entire processing pipeline rather than just at the initial input stage, preventing the leakage of special framework configuration keys into the system's object creation process.