CVE-2026-78416: CWE-915 Improperly controlled modification of Dynamically-Determined object attributes in craftcms cms

CVE-2026-78416 is an authenticated remote code execution vulnerability affecting Craft CMS. It impacts versions starting from 4.0.0-RC1 up to but not including 4.18.2, and from 5.0.0-RC1 up to but not including 5.10.6. The flaw exists in the control panel's element-search condition handling, where a JSON cleanse bypass in condition.config permits Yii behavior/event configuration keys to be interpreted after decoding. This improper control of dynamically-determined object attributes (CWE-915) allows an attacker with authenticated access to execute arbitrary commands as the PHP/web user.

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the server with the privileges of the PHP/web user. This can lead to full system compromise, data theft, or further attacks within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the control panel to trusted users only and monitor for suspicious activity related to element-search condition handling. Avoid using affected versions in production environments if possible.