Skip to content
Fencer Vulns
high 8.8

CVE-2026-72778 json

Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

published 2026-08-06 3 mo ago modified 2026-10-24 16 d ago also EUVD-2026-56102 , GHSA-265m-7826-wjqm

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as 'as ...' and 'on ...' can be hidden inside it and, after JSON decoding, are interpreted by Yii as behavior/event configuration during FieldLayout object creation. An attacker with an authenticated control panel session (and a valid CSRF token) can exploit this to execute operating system commands as the PHP/web user.

Patch / fix

  • packagist craftcms/cms 4.18.2, 5.10.6
  • craftcms cms 4.18.2, 5.10.6

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
packagist craftcms/cms
>=5.0.0-RC1, <5.10.6
>=4.0.0-RC1, <4.18.2
5.10.6
4.18.2

Affected products

  • craftcms cms

Classification

Weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.