CVE-2026-78416: Craft CMS RCE Vulnerability

CVE-2026-78416 is a remote code execution vulnerability in Craft CMS affecting versions 4.0.0-RC1 to 4.18.1 and 5.0.0-RC1 to 5.10.5. Authenticated attackers can execute arbitrary code via control panel element-search conditions. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-78416 Overview

CVE-2026-78416 is an authenticated remote code execution vulnerability in Craft CMS affecting versions 4.0.0-RC1 before 4.18.2 and 5.0.0-RC1 before 5.10.6. The flaw resides in the control panel element-search condition handling logic. A JSON cleanse bypass in condition.config allows Yii framework behavior and event configuration keys to be interpreted after decoding. An authenticated attacker with control panel access can leverage this to execute arbitrary commands as the PHP or web server user.

Critical Impact
Authenticated attackers can execute arbitrary commands on the underlying host as the PHP/web user, enabling full application compromise and lateral movement.

Affected Products

Craft CMS 4.x from 4.0.0-RC1 before 4.18.2
Craft CMS 5.x from 5.0.0-RC1 before 5.10.6
Deployments exposing the Craft CMS control panel to authenticated users

Discovery Timeline

2026-08-24 - CVE-2026-78416 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78416

Vulnerability Analysis

The vulnerability is classified under [CWE-915] Improperly Controlled Modification of Dynamically-Determined Object Attributes. Craft CMS accepts a condition.config parameter through element-search functionality in the control panel. The application applies a JSON cleanse routine intended to strip dangerous configuration keys before instantiating objects. The cleanse operates on the pre-decoded payload, but the framework interprets configuration keys after decoding, allowing crafted keys to survive the sanitization step.

Because Craft CMS is built on the Yii framework, configuration arrays may specify as behavior attachments and on event handlers. An attacker who supplies these keys after the cleanse bypass can attach a behavior or event that resolves to arbitrary callable code. When Yii instantiates the resulting object, the injected callable runs in the context of the web server process.

Root Cause

The root cause is a mismatch between the input sanitization stage and the object-instantiation stage. The JSON cleanse fails to normalize the payload before filtering, so nested or encoded configuration keys reach the Yii Yii::createObject() path. Yii treats keys prefixed with as and on as behavior and event bindings, transforming attacker-controlled data into executable code paths.

Attack Vector

Exploitation requires an authenticated Craft CMS session with permission to reach the control panel element-search endpoints. The attacker submits a crafted condition.config value containing Yii behavior or event configuration keys. After the bypassed cleanse, the server instantiates the malicious configuration and invokes the attacker-supplied callable, resulting in command execution as the PHP or web user. No user interaction is required beyond the authenticated request.

No verified public exploit code has been referenced in the advisory. See the HCKRT JD662P Hacktivity Analysis for additional technical context.

Detection Methods for CVE-2026-78416

Indicators of Compromise

Unexpected condition.config parameters in control panel HTTP requests containing as or on prefixed keys
PHP-FPM or web server processes spawning shell interpreters such as /bin/sh, bash, or python
New or modified files under Craft CMS web roots, particularly in web/, templates/, or storage/runtime/
Outbound network connections from the web server to attacker infrastructure following control panel activity

Detection Strategies

Inspect web server access logs for authenticated POST requests to element-search endpoints carrying serialized condition payloads
Alert on process-tree anomalies where php-fpm or Apache httpd spawns command interpreters or reconnaissance binaries
Deploy web application firewall rules that flag JSON bodies containing Yii behavior keys such as as or on inside condition.config

Monitoring Recommendations

Enable Craft CMS audit logging for administrative and content editor accounts accessing the control panel
Forward web server, PHP, and host telemetry to a centralized platform for correlation of authentication and process events
Baseline outbound egress from application servers and alert on connections to unrecognized destinations

How to Mitigate CVE-2026-78416

Immediate Actions Required

Upgrade Craft CMS 5.x installations to version 5.10.6 or later without delay
Upgrade Craft CMS 4.x installations to version 4.18.2 or later
Rotate control panel account credentials and session keys after patching, prioritizing privileged accounts
Review recent control panel activity logs for suspicious element-search requests preceding the patch window

Patch Information

The Craft CMS project released fixed versions 4.18.2 and 5.10.6 that correct the JSON cleanse to normalize input before filtering Yii behavior and event keys. Release notes and source diffs are available at the GitHub Craft CMS Release 5.10.6 page and in the main GitHub Craft CMS Repository.

Workarounds

Restrict control panel access to trusted IP ranges using reverse proxy or firewall rules until patches are applied
Reduce the number of accounts with control panel permissions and enforce multi-factor authentication on those accounts
Deploy a web application firewall rule that inspects JSON payloads for Yii behavior keys under condition.config and blocks matches

bash

# Example: Composer upgrade to a fixed Craft CMS release
composer require craftcms/cms:^5.10.6 --update-with-dependencies
php craft up