Craft CMS EUVD-2026-64920

Exploitation requires an authenticated session in the Craft CMS control panel with at minimum the access level necessary to interact with element-search condition rules - typically an editor or higher role. The vulnerable code path is specifically the element-search condition handling endpoint within the control panel, so the attacker must be able to reach the admin interface over the network (default path /admin or custom equivalent). No additional non-default Craft CMS configuration is required beyond a standard installation with the control panel enabled; the vulnerability is present in the default feature set across all affected 4.x and 5.x versions. Exploitation is concretely limited by: (1) the PR:L authentication requirement - unauthenticated exploitation is not possible without a prior credential compromise step; (2) control panel network accessibility - if the admin interface is restricted to internal networks or protected by IP allowlisting or VPN, remote exploitation requires additional access steps; (3) execution scope - code runs as the PHP/web server user, not as root, so post-exploitation lateral movement depends on web user privileges in the hosting environment.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately reflects the primary risk profile: network-reachable, low-complexity exploitation requiring only low-privilege authenticated access, with full confidentiality, integrity, and availability impact on the vulnerable system. The PR:L requirement is the dominant mitigating factor - an attacker must hold valid Craft CMS control panel credentials before exploitation is possible, ruling out pure internet-facing unauthenticated attacks. That said, credential compromise via phishing, password reuse, or credential stuffing is a well-established initial access path and should not be treated as a reliable barrier; even a mid-sized organization that relies on weak password hygiene rather than MFA for its CMS should treat this as urgent. No EPSS score was provided in the available intelligence; no CISA KEV listing exists at time of analysis, and no confirmed public exploit code has been identified, meaning the current exploitation status is 'no public exploit identified at time of analysis.' The absence of scope change (SC:N/SI:N/SA:N) is appropriate: impact is bounded to the CMS application layer unless the web server process has broader operating system privileges. Overall, the combination of low attack complexity, low privilege requirement, and full RCE impact makes this a genuine priority patch - the PR:L gating condition lowers urgency compared to PR:N vulnerabilities but does not eliminate it.

An attacker who has acquired low-privilege Craft CMS control panel credentials - via credential stuffing against a reused password, a phishing campaign targeting a content editor, or access to a leaked credential database - submits a crafted HTTP request to the element-search condition endpoint with a malicious condition.config JSON payload embedding Yii behavior or event configuration keys. The JSON cleanse bypass allows these keys to survive sanitization and be processed by Yii's component configuration layer after decoding, triggering arbitrary PHP code execution as the web server user. No confirmed public exploit code exists at time of analysis, though the Yii behavior injection pattern is publicly documented in the security research community, making independent exploit development accessible to skilled adversaries familiar with the Yii framework.