Saladin0X1

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 **Description** An authenticated remote code execution issue exists in the control panel element-search condition handling. The software uses `Component::cleanseConfig()` to cleanse the outer request-controlled condition array, but the `Conditions::createCondition()` function subsequently decodes and merges the JSON string in `condition.config` without re-applying the cleansing process. This allows special configuration keys, such as `as ...` and `on ...`, to be hidden within the JSON string. Upon decoding, these keys are interpreted as behavior or event configurations during the creation of the `FieldLayout` object. An attacker with a valid control panel session and a CSRF token can exploit this to execute operating system commands with the privileges of the PHP/web user. **Recommendations** Update to version 4.18.2 or later. Update to version 5.10.6 or later.