CVE-2026-78416 is an authenticated remote code execution vulnerability affecting Craft CMS. The flaw exists in the control panel element-search condition handling where a JSON cleanse bypass in condition.config allows Yii framework behavior/event configuration keys to be processed after JSON decoding. This improper control of dynamically-determined object attributes (CWE-915) enables an attacker with authenticated access to execute arbitrary commands as the PHP/web user. The vulnerability affects Craft CMS versions from 4.0.0-RC1 up to but not including 4.18.2, and from 5.0.0-RC1 up to but not including 5.10.6.

An attacker with authenticated access to the Craft CMS control panel can exploit this vulnerability to execute arbitrary code on the server with the privileges of the PHP/web user. This can lead to full system compromise depending on the server configuration and privileges of the web user. The vulnerability has a high CVSS 4.0 score of 8.7, reflecting its critical impact and ease of exploitation given low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict authenticated access to trusted users only and monitor for suspicious activity related to element-search condition handling.