# Craft CMS authenticated RCE via condition.config JSON cleanse bypass

Source: https://junglewise.ai/threats/craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.8 · Published 2026-08-11

Craft CMS is a popular content management system used to build and manage websites. A vulnerability in the control panel allows authenticated users (those with valid login credentials and a CSRF token) to execute arbitrary operating system commands by bypassing security validation of configuration parameters. An attacker could read sensitive data, modify site content, access database credentials, or establish persistence on the server.

Technologies: [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.8, published 11 August 2026.

**Which products and versions are affected?** craftcms/cms (Packagist) >= 4.0.0-RC1, < 4.18.2.

**Is there a fix for This vulnerability?** A patch was published on 2026-07-25: Versions 4.18.2 and 5.10.6 released with patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a configuration validation bypass (CWE-915) in Craft CMS's element-search condition handling. Craft::cleanseConfig() sanitizes the outer condition array, but Conditions::createCondition() later JSON-decodes the condition.config field without re-running cleanseConfig(). Because the JSON string bypasses initial validation, Yii special config keys ('as ...' and 'on ...' for behavior and event handlers) can be hidden inside and are interpreted during FieldLayout object creation. Attack vector is network-based and requires an authenticated control panel session with a valid CSRF token. An attacker can execute arbitrary OS commands as the PHP/web user, read environment variables and secrets, access database credentials, modify site content, or pivot to internal services. The exploit is described as "semi-blind" with output verification via server-side side effects. Patches are available in versions 4.18.2 and 5.10.6.

## Affected products

- Craft CMS Craft CMS 4.0.0-RC1 to 4.18.1, 5.0.0-RC1 to 5.10.5

## Timeline

- 2026-07-25: disclosed
- 2026-07-25: patched: Versions 4.18.2 and 5.10.6 released with patch
- 2026-08-11: advisory: GHSA-265m-7826-wjqm primary advisory published; GHSA-w36c-qxrq-v7fw is a duplicate

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-265m-7826-wjqm](https://github.com/craftcms/cms/security/advisories/GHSA-265m-7826-wjqm)
- [https://www.vulncheck.com/advisories/craft-cms-rc1-before-authenticated-rce-via-condition-config](https://www.vulncheck.com/advisories/craft-cms-rc1-before-authenticated-rce-via-condition-config)

## Related threats

- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)
- [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058)