CVE-2026-72778: Craft CMS RCE Vulnerability

CVE-2026-72778 Overview

CVE-2026-72778 is an authenticated remote code execution vulnerability in Craft CMS affecting versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6. The flaw resides in the control panel element-search condition handling. Craft sanitizes the outer condition array through Component::cleanseConfig(), but the nested condition.config JSON string is decoded and merged later without re-sanitization. This allows Yii special configuration keys such as as ... and on ... to survive inside the encoded payload. When Yii instantiates the resulting FieldLayout object, those keys are interpreted as behavior or event handlers, enabling command execution as the PHP web user.

Critical Impact
An authenticated control panel user with a valid CSRF token can execute arbitrary operating system commands as the PHP/web user, leading to full compromise of the Craft CMS host.

Affected Products

Craft CMS versions 4.0.0-RC1 through 4.18.1
Craft CMS versions 5.0.0-RC1 through 5.10.5
Deployments exposing the /admin control panel to authenticated users

Discovery Timeline

2026-08-11 - CVE-2026-72778 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72778

Vulnerability Analysis

The vulnerability is a classic case of improperly controlled modification of dynamically-determined object attributes [CWE-915]. Craft CMS relies on the Yii framework, which supports declarative configuration keys prefixed with as and on to attach behaviors and event handlers during object construction. Craft's Component::cleanseConfig() routine strips these dangerous keys from user-controlled configuration arrays to prevent abuse.

The sanitization runs once against the outer condition array received from the control panel. At that point, condition.config is still a JSON-encoded string, so the cleansing routine does not descend into it. Later, Conditions::createCondition() decodes the JSON string and merges the resulting associative array into the configuration used to build the condition object. The malicious as ... and on ... keys embedded inside the JSON blob survive intact and are honored by Yii during FieldLayout instantiation.

Root Cause

The root cause is inconsistent application of the sanitization boundary. Component::cleanseConfig() operates on decoded arrays, but condition.config is passed through the boundary as an opaque JSON string. The subsequent decode-and-merge step reintroduces attacker-controlled keys into an object-construction path without a second cleansing pass.

Attack Vector

Exploitation requires an authenticated session on the Craft CMS control panel and a valid CSRF token. The attacker sends a crafted element-search request in which condition.config contains a JSON-encoded object with Yii behavior keys pointing to arbitrary classes or callable event handlers. When Craft creates the FieldLayout, Yii wires the malicious behavior and triggers command execution under the PHP/web user account. Any authenticated user reachable through account takeover, weak credentials, or low-privilege editor roles with control panel access can be leveraged as a foothold.

No verified public proof-of-concept code is available at this time. Refer to the GitHub Security Advisory and the VulnCheck Craft CMS Advisory for technical details.

Detection Methods for CVE-2026-72778

Indicators of Compromise

Control panel POST requests to element-search endpoints containing condition[config] payloads with JSON strings including the substrings "as " or "on " as object keys.
Unexpected child processes of the PHP-FPM or web server process (php-fpm, www-data, nginx, apache2) such as shells, curl, wget, or interpreter invocations.
New or modified files in the Craft CMS web/ or storage/runtime/ directories written by the web user.
Outbound network connections initiated by the web server process to unfamiliar hosts.

Detection Strategies

Inspect HTTP request bodies destined for control panel routes for condition.config JSON blobs and alert on Yii behavior keys (as or on prefixed strings) inside the decoded structure.
Correlate control panel authentication events with process-execution telemetry from the web host to identify authenticated sessions that precede shell activity.
Baseline the child-process tree of the PHP runtime and alert on deviations, particularly command interpreters spawned from PHP.

Monitoring Recommendations

Enable and forward Craft CMS admin audit logs, web server access logs, and host process telemetry to a central analytics platform.
Monitor for privilege changes, cron entries, and web shell artifacts in Craft's document root following any suspicious control panel activity.
Track failed and successful control panel logins to detect credential-stuffing precursors to exploitation.

How to Mitigate CVE-2026-72778

Immediate Actions Required

Upgrade Craft CMS to 4.18.2 or 5.10.6 without delay.
Rotate all control panel user credentials, API keys, and security tokens after patching, assuming any exposure occurred.
Restrict access to the /admin control panel to trusted networks or via VPN until patching is verified.
Audit control panel user accounts and remove stale or unnecessary administrators and editors.

Patch Information

The Craft CMS maintainers released fixed versions 4.18.2 and 5.10.6. According to the GitHub Security Advisory, the fix re-runs Component::cleanseConfig() on the decoded condition.config structure inside Conditions::createCondition(), ensuring Yii behavior and event keys cannot be smuggled through the JSON boundary.

Workarounds

Block or firewall access to the Craft CMS control panel from the public internet where feasible.
Enforce multi-factor authentication for all control panel accounts to reduce the likelihood of authenticated exploitation.
Run the PHP/web user with the least privileges necessary and isolate the Craft host using containerization or mandatory access controls such as SELinux or AppArmor.

bash

# Upgrade Craft CMS using Composer
composer require craftcms/cms:^5.10.6 --update-with-dependencies
# Or for the 4.x branch
composer require craftcms/cms:^4.18.2 --update-with-dependencies

# Apply pending migrations and clear caches
php craft up
php craft clear-caches/all