Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass (CVE-2026-72778)
Craft CMS contains an authenticated remote code execution vulnerability in its control panel element-search condition handling. The flaw arises because the JSON string in the 'condition.config' parameter bypasses the intended configuration cleansing, allowing Yii behavior/event configuration injection. Exploitation requires an authenticated control panel session and a valid CSRF token. Successful exploitation can lead to command execution as the PHP/web user, exposing secrets, database credentials, and enabling site content modification or further internal pivoting.
AI Analysis
Technical Summary
Craft CMS versions >=4.0.0-RC1 <4.18.2 and >=5.0.0-RC1 <5.10.6 have an authenticated RCE vulnerability (CVE-2026-72778) due to improper cleansing of the 'condition.config' JSON string in element-search condition handling. The initial cleanse via Component::cleanseConfig() does not reprocess the decoded JSON string, allowing special Yii keys like 'as' and 'on' to be interpreted as behavior/event configurations during FieldLayout object creation. This leads to semi-blind remote code execution with command output verified via server-side side effects. Exploitation requires an authenticated control panel session and a valid CSRF token.
Potential Impact
An authenticated attacker with control panel access can execute arbitrary operating system commands as the PHP/web user. This enables reading sensitive data such as Craft secrets, environment variables, and database credentials, modifying site content and user data, and potentially pivoting to internal services accessible from the Craft host. The vulnerability can also be used to cause denial of service or establish persistence depending on deployment permissions.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to Craft CMS versions 4.18.2 or later and 5.10.6 or later where this issue is fixed. No additional mitigation is required if the patch is applied.
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass (CVE-2026-72778)
Description
Craft CMS contains an authenticated remote code execution vulnerability in its control panel element-search condition handling. The flaw arises because the JSON string in the 'condition.config' parameter bypasses the intended configuration cleansing, allowing Yii behavior/event configuration injection. Exploitation requires an authenticated control panel session and a valid CSRF token. Successful exploitation can lead to command execution as the PHP/web user, exposing secrets, database credentials, and enabling site content modification or further internal pivoting.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Craft CMS versions >=4.0.0-RC1 <4.18.2 and >=5.0.0-RC1 <5.10.6 have an authenticated RCE vulnerability (CVE-2026-72778) due to improper cleansing of the 'condition.config' JSON string in element-search condition handling. The initial cleanse via Component::cleanseConfig() does not reprocess the decoded JSON string, allowing special Yii keys like 'as' and 'on' to be interpreted as behavior/event configurations during FieldLayout object creation. This leads to semi-blind remote code execution with command output verified via server-side side effects. Exploitation requires an authenticated control panel session and a valid CSRF token.
Potential Impact
An authenticated attacker with control panel access can execute arbitrary operating system commands as the PHP/web user. This enables reading sensitive data such as Craft secrets, environment variables, and database credentials, modifying site content and user data, and potentially pivoting to internal services accessible from the Craft host. The vulnerability can also be used to cause denial of service or establish persistence depending on deployment permissions.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to Craft CMS versions 4.18.2 or later and 5.10.6 or later where this issue is fixed. No additional mitigation is required if the patch is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-265m-7826-wjqm
- Osv Schema Version
- 1.4.0
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a7573c1bf8831d539d945b1
Added to database: 08/07/2026, 05:57:21 UTC
Last enriched: 09/12/2026, 06:32:03 UTC
Last updated: 09/22/2026, 23:09:57 UTC
Views: 44
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.