CVE-2026-78416 in Craft CMS
Summary
by MITRE • 08/24/2026
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/24/2026
Craft CMS versions ranging from 4.0.0-RC1 up to but not including 4.18.2, and from 5.0.0-RC1 up to but not including 5.10.6, are susceptible to a critical authenticated remote code execution vulnerability within the control panel element search functionality. This flaw resides specifically in how the application handles condition configurations for searching elements through its administrative interface. The core technical issue stems from an insufficient input validation and sanitization process during the parsing of JSON payloads submitted by authenticated users. When a user interacts with the search feature, they can supply structured data that is processed as part of the query conditions. Due to a flaw in the cleansing logic applied to these configurations, specific maliciously crafted keys intended for Yii framework behavior or event configuration are not properly stripped or escaped before being interpreted by the underlying PHP engine.
The vulnerability exploits the way Craft CMS integrates with the Yii2 framework, which supports dynamic binding of behaviors and events through array-based configuration structures. By injecting specially formatted JSON data into the condition.config parameter, an attacker can bypass the expected sanitization routines that are designed to filter out dangerous input patterns. Once this cleansing mechanism is circumvented, the application proceeds to decode and process these keys as legitimate Yii behavior or event definitions. This misinterpretation allows the system to instantiate arbitrary PHP objects or invoke methods with parameters controlled by the attacker. Consequently, this leads directly to remote code execution under the context of the web server user account, which typically possesses significant privileges within the hosting environment.
From a threat modeling perspective, this vulnerability aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-501 Trust Boundary Violation, as it involves bypassing security controls at the boundary between untrusted user input and trusted system processing logic. In terms of the MITRE ATT&CK framework, this attack vector corresponds to T1059 Command and Scripting Interpreter, specifically leveraging PHP execution capabilities, and potentially T1190 Exploit Public-Facing Application if the administrative interface is accessible over a network without adequate access controls or multi-factor authentication. The severity is exacerbated by the fact that it requires only authenticated access rather than full administrator privileges in some configurations, although typically an attacker would need at least editor-level permissions to utilize the search features effectively.
The operational impact of this vulnerability is severe, as successful exploitation grants an attacker complete control over the underlying server processes running the web application. This can lead to unauthorized data exfiltration, modification or deletion of content and database records, installation of persistent backdoors such as web shells, and lateral movement within the internal network if the web user has access to other services. Attackers could also use this execution capability to pivot into more sensitive systems by leveraging credentials found in configuration files or environment variables that are often readable by the web process. The ability to execute arbitrary code means that the confidentiality, integrity, and availability of the entire CMS platform and its associated data assets are compromised.
Mitigation strategies must prioritize immediate patching as the primary defense vector. Administrators running affected versions should upgrade Craft CMS to version 4.18.2 or later for the 4.x branch, or version 5.10.6 or later for the 5.x branch immediately upon availability. These updates contain specific fixes that enforce stricter validation on JSON inputs and prevent the interpretation of unauthorized configuration keys within search conditions. In environments where immediate patching is not feasible due to compatibility concerns with custom plugins or themes, temporary mitigations should be implemented at the web server level. This includes configuring Web Application Firewalls to detect and block requests containing suspicious patterns associated with Yii behavior injection in JSON payloads targeting element search endpoints. Additionally, restricting access to the control panel via IP whitelisting for administrative users can significantly reduce the attack surface by ensuring that only trusted sources can interact with the vulnerable functionality. Regular security audits of custom code interacting with CMS APIs are also recommended to ensure no similar patterns exist outside of core features.