CVE-2026-72778

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5

Description An authenticated remote code execution issue exists in the control panel element-search condition handling. The software uses Component::cleanseConfig() to cleanse the outer request-controlled condition array, but the Conditions::createCondition() function subsequently decodes and merges the JSON string in condition.config without re-applying the cleansing process. This allows special configuration keys, such as as ... and on ..., to be hidden within the JSON string. Upon decoding, these keys are interpreted as behavior or event configurations during the creation of the FieldLayout object. An attacker with a valid control panel session and a CSRF token can exploit this to execute operating system commands with the privileges of the PHP/web user.

Recommendations Update to version 4.18.2 or later. Update to version 5.10.6 or later.