Executive brief
Craft CMS is a popular content management system used to build and manage websites and applications. Authenticated users with valid control panel access can execute arbitrary operating system commands by exploiting a flaw in how the application validates configuration parameters, potentially allowing them to read sensitive data, modify site content, access database credentials, or take control of the server.
Technical details
This vulnerability is a configuration cleansing bypass in the element-search condition handling of Craft CMS control panel. The root cause is that Component::cleanseConfig() sanitizes the outer request-controlled condition array to strip dangerous Yii configuration keys (like 'as ...' and 'on ...'), but Conditions::createCondition() later decodes a JSON string from condition.config without re-running the cleanse operation. Since the JSON string bypasses the initial cleansing filter, attackers can embed Yii special config keys inside the JSON that are then interpreted as behavior/event directives during FieldLayout object creation, leading to remote code execution. Attack preconditions: the attacker must possess a valid authenticated control panel session and a valid CSRF token. The RCE is semi-blind—the trigger endpoint returns a normal JSON response, and command output is verified via server-side file-write side effects. Patches are available in Craft CMS 4.18.2 and 5.10.6.
Affected products
- Craft CMS 4.0.0-RC1 to 4.18.1, 5.0.0-RC1 to 5.10.5
Timeline
- 2026-07-25: disclosed: GitHub Security Advisory (GHSA-265m-7826-wjqm) published
- 2026-08-11: advisory: CVE-2026-72778 and NVD advisory published
- 2026-07-25: patched: Patches released: Craft CMS 4.18.2 and 5.10.6