Craft CMS authenticated RCE via condition.config JSON cleanse bypass

Executive brief

Craft CMS, a popular content management system, is vulnerable to a security flaw that allows an authenticated user with access to the control panel to execute arbitrary commands on the server. By bypassing internal security filters, an attacker could gain full control over the website's hosting environment, potentially leading to data theft, site defacement, or unauthorized access to the underlying database. This issue affects versions 4.x and 5.x and requires a valid login and CSRF token to exploit.

Technical details

An authenticated remote code execution (RCE) vulnerability exists in Craft CMS due to improper handling of object attributes (CWE-915) within the element-search condition functionality. While the application uses `Component::cleanseConfig()` to sanitize request data, `Conditions::createCondition()` subsequently decodes a JSON string in `condition.config` and merges it without re-running the security cleanse. This allows an attacker to inject Yii-specific configuration keys (such as 'as' or 'on') that are interpreted as behavior or event configurations during FieldLayout object creation. Exploitation requires an authenticated control panel session and a valid CSRF token. The vulnerability is patched in versions 4.18.2 and 5.10.6.

Affected products

• craftcms Craft CMS >= 4.0.0-RC1, < 4.18.2; >= 5.0.0-RC1, < 5.10.6

Timeline

• 2026-07-25: disclosed: Initial disclosure to vendor
• 2026-08-06: advisory: GitHub Advisory published
• 2026-08-06: patched: Fixes released in versions 4.18.2 and 5.10.6

References

• https://api.github.com/users/saladin0x1
• https://github.com/saladin0x1
• https://api.github.com/users/saladin0x1/gists%7B/gist_id%7D
• https://api.github.com/users/saladin0x1/repos
• https://avatars.githubusercontent.com/u/50548046?v=4
• https://api.github.com/users/saladin0x1/events%7B/privacy%7D