CVE-2026-78416 — Authenticated RCE via `condition.config` JSON cleanse bypass
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search con…
Published: 2026-08-24 · CVSS: 8.7 · CVSS 4.0
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7