Executive brief
Craft CMS is a popular content management system used to build and manage digital content. Authenticated users can exploit a flaw in the control panel's element search feature to execute arbitrary PHP commands on the server, allowing attackers with valid login credentials to take full control of the website and underlying server.
Technical details
The vulnerability is a remote code execution flaw in Craft CMS's element-search condition handling. A JSON cleanse bypass in the condition.config parameter allows attackers to inject Yii framework behavior/event configuration keys that are interpreted after JSON decoding. This permits arbitrary command execution in the context of the PHP web server process. The attack requires authentication to the control panel. Patches are available in versions 4.18.2 and 5.10.6 or later.
Affected products
- Craft CMS 4.0.0-RC1 to 4.18.1, 5.0.0-RC1 to 5.10.5
Timeline
- 2026-08-24: disclosed