The vulnerability in Craft CMS stems from improper handling of the 'condition.config' JSON string within the control panel's element-search condition processing. Although the outer request-controlled condition array is cleansed using 'Component::cleanseConfig()', the JSON string inside 'condition.config' is decoded and merged without a subsequent cleanse. This allows an attacker with authenticated access and a valid CSRF token to inject Yii special config keys such as 'as' and 'on', which are interpreted as behavior or event configurations by Yii during FieldLayout object creation. This leads to semi-blind remote code execution, where command output is verified through server-side side effects. The vulnerability enables execution of arbitrary OS commands as the PHP/web user and access to sensitive application data and configuration.

An authenticated user with control panel access can execute arbitrary operating system commands as the PHP/web user. This includes reading sensitive Craft CMS secrets, environment variables, application configuration, and database credentials. The attacker can modify site content, user accounts, and application state, potentially causing denial of service or establishing persistence. Additionally, the attacker may pivot to internal services accessible from the Craft host or container, increasing the scope of compromise.

A patch is available for this vulnerability. Users should apply the official fix provided by the Craft CMS vendor to ensure that the 'condition.config' JSON string is properly cleansed before processing. Since this is not a cloud service, remediation depends on applying the vendor's patch. Check the vendor advisory for the latest patch details and update instructions.