Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS versions 4.0.0-RC1 up to but not including 4.18.2 and 5.0.0-RC1 up to but not including 5.10.6 have an authenticated remote code execution vulnerability. The issue is in the control panel element-search condition handling where the outer request-controlled condition array is cleansed via Component::cleanseConfig(), but the JSON string in condition.config is decoded and merged without reapplying cleanseConfig(). This allows Yii special config keys such as 'as ...' and 'on ...' to be hidden inside the JSON string and interpreted as behavior/event configuration during FieldLayout object creation, enabling command execution as the PHP/web user by an authenticated attacker with a valid CSRF token.

An attacker who has an authenticated control panel session and a valid CSRF token can exploit this vulnerability to execute arbitrary operating system commands with the privileges of the PHP/web user. This can lead to full system compromise depending on the privileges of the web server user.

A fix is available in Craft CMS versions 4.18.2 and later, and 5.10.6 and later. Users should upgrade to these versions or later to remediate this vulnerability. No other mitigation guidance is provided in the advisory.