EUVD-2026-56102
GHSA-w36c-qxrq-v7fw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible control panel (AV:N), no complexity barriers once authenticated (AC:L), requires only a low-privilege account (PR:L), no scope change as impact is confined to the Craft host.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as 'as ...' and 'on ...' can be hidden inside it and, after JSON decoding, are interpreted by Yii as behavior/event configuration during FieldLayout object creation. An attacker with an authenticated control panel session (and a valid CSRF token) can exploit this to execute operating system commands as the PHP/web user.
Articles & Coverage 1
AnalysisAI
Authenticated remote code execution in Craft CMS control panels allows any user with a valid panel session to execute operating system commands as the PHP/web user by exploiting a config-cleanse bypass in element-search condition handling. Affected versions span the 4.x branch from 4.0.0-RC1 through 4.18.1, and the 5.x branch from 5.0.0-RC1 through 5.10.5. The GHSA advisory confirms lab-verified exploitation; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Technical ContextAI
Craft CMS is a PHP-based content management system distributed via Composer (craftcms/cms). The vulnerability exploits CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes - manifesting specifically through Yii2 framework's dynamic configuration system. Yii2 interprets special array keys prefixed with 'as ' (behaviors) and 'on ' (event handlers) during object creation via Yii::createObject(). Craft's Component::cleanseConfig() correctly strips these keys from the outer request-controlled condition array, but the condition.config sub-key is a JSON-encoded string at the time of cleansing. Because cleanseConfig() sees only an opaque string, not a decoded array, malicious Yii keys embedded within that JSON string pass through unfiltered. When Conditions::createCondition() later decodes the JSON and merges the result into configuration that is passed to FieldLayout object creation, the 'as ...' and 'on ...' keys are now top-level array entries visible to Yii's object factory, which interprets and invokes them as behavior or event configuration - enabling arbitrary PHP and OS command execution. The CPE cpe:2.3:a:craftcms:cms covers both affected major version lines.
RemediationAI
The primary fix is to upgrade Craft CMS to version 4.18.2 (for 4.x deployments) or 5.10.6 (for 5.x deployments); these are the vendor-confirmed fixed versions per GHSA-265m-7826-wjqm. The underlying patches are available at commit 353b5d676c88a854c9f6409ad83b837ca0c0e8da and 789789dc9e2a4e2f2562f51aaf879fb7757d8340 in the craftcms/cms repository. If immediate upgrade is not feasible, the most effective compensating control is to restrict control panel access to trusted IP ranges via network-level firewall rules or web server configuration (e.g., allow-listing office/VPN egress IPs for the /admin path), which eliminates the network attack vector while preserving site functionality; this introduces the operational trade-off of blocking legitimate remote editors. Disabling non-essential control panel user accounts and enforcing minimum-privilege account policies reduces the pool of potential attackers in the interim. There is no known configuration toggle within Craft itself that disables the vulnerable condition-handling code path without patching.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today