CVE-2026-78416
Received Received - Intake

Authenticated Remote Code Execution in Craft CMS via JSON Cleanse Bypass

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Hackrate

Description
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78416
EUVD
EUVD-2026-64920

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
craftcms craft_cms to 4.18.2 (exc)
craftcms craft_cms to 5.10.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78416 is an authenticated remote code execution (RCE) vulnerability in Craft CMS versions 4.0.0-RC1 to 4.18.1 and 5.0.0-RC1 to 5.10.5. It occurs due to improper handling of the condition.config parameter during element-search processing. Attackers can bypass input sanitization by smuggling Yii configuration keys like 'as' or 'on' in JSON strings, which are then interpreted as behavior or event configurations. Exploitation requires an authenticated Craft control panel session and a valid CSRF token.

Detection Guidance

Check Craft CMS versions. Run: curl -s https://your-craft-site.com/admin/dashboard | grep -i 'Craft CMS' to identify version. Affected versions are >=5.0.0-RC1 and <5.10.6 or >=4.0.0-RC1 and <4.18.2. Monitor control panel element-search requests for unusual JSON payloads containing 'condition.config' with Yii config keys like 'as' or 'on'.

Impact Analysis

Successful exploitation allows attackers to execute operating system commands as the PHP/web user. This could lead to reading Craft secrets, environment variables, database credentials, and stored site content. Attackers may also modify site content and users, pivot to internal services, or cause denial of service. The vulnerability requires an authenticated session but enables full system compromise once exploited.

Compliance Impact

This vulnerability allows authenticated attackers to execute remote code on the server as the PHP/web user. This could lead to unauthorized access to sensitive data such as database credentials, environment variables, and stored site content, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if such data is processed or stored.

Mitigation Strategies

Upgrade Craft CMS immediately to version 5.10.6 or later. If upgrading is not possible, restrict access to the control panel, disable element-search functionality, and implement strict input validation for JSON payloads in condition.config parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart