Craft CMS contains an authenticated remote code execution vulnerability in its control panel element-search condition handling. The flaw arises because the JSON string in the 'condition.config' parameter bypasses the intended configuration cleansing, allowing Yii behavior/event configuration injection. Exploitation requires an authenticated control panel session and a valid CSRF token. Successful exploitation can lead to command execution as the PHP/web user, exposing secrets, database credentials, and enabling site content modification or further internal pivoting.