CVE-2026-78416

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.

CVSS

No CVSS.

References

Link	Resource
https://github.com/craftcms/cms
https://github.com/craftcms/cms/releases/tag/5.10.6
https://www.hckrt.com/hacktivity/HCKRT-JD662P

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Craft CMS desde la 4.0.0-RC1 anteriores a la 4.18.2 y desde la 5.0.0-RC1 anteriores a la 5.10.6 contienen una vulnerabilidad de ejecución remota de código autenticada en el manejo de condiciones de búsqueda de elementos del panel de control. Una omisión de limpieza JSON en condition.config permite que las claves de configuración de comportamiento/evento de Yii sean interpretadas después de la decodificación, lo que permite la ejecución de comandos como el usuario PHP/web.

Information

Published : 2026-08-24 16:17

Updated : 2026-10-12 15:10

NVD link : CVE-2026-78416

Mitre link : CVE-2026-78416

CVE.ORG link : CVE-2026-78416

JSON object : View

Products Affected

No product.

CWE

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

{"id": "CVE-2026-78416", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78416", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T00:00:00+00:00"}}], "cvssMetricV40": [{"type": "Secondary", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "affectedData": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": "4.0.0-RC1", "lessThan": "4.18.2", "versionType": "semver"}, {"status": "affected", "version": "5.0.0-RC1", "lessThan": "5.10.6", "versionType": "semver"}], "packageName": "craftcms/cms", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T16:17:24.250", "references": [{"url": "https://github.com/craftcms/cms", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}, {"url": "https://github.com/craftcms/cms/releases/tag/5.10.6", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}, {"url": "https://www.hckrt.com/hacktivity/HCKRT-JD662P", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "description": [{"lang": "en", "value": "CWE-915"}]}], "descriptions": [{"lang": "en", "value": "Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user."}, {"lang": "es", "value": "Las versiones de Craft CMS desde la 4.0.0-RC1 anteriores a la 4.18.2 y desde la 5.0.0-RC1 anteriores a la 5.10.6 contienen una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo autenticada en el manejo de condiciones de b\u00fasqueda de elementos del panel de control. Una omisi\u00f3n de limpieza JSON en condition.config permite que las claves de configuraci\u00f3n de comportamiento/evento de Yii sean interpretadas despu\u00e9s de la decodificaci\u00f3n, lo que permite la ejecuci\u00f3n de comandos como el usuario PHP/web."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}