Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-78416

Authenticated RCE via `condition.config` JSON cleanse bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Hackrate

Description

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

craftcms cms

Default version status: unaffected

  • 4.0.0-RC1 to < 4.18.2affected
  • 5.0.0-RC1 to < 5.10.6affected

References