{"id":"CVE-2026-78416","title":"Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling","summary":"Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config a…","severity":"none","cwe":["CWE-915"],"published":"2026-08-24","updated":"2026-10-12","sourceUpdated":"2026-10-12T15:10:00.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78416","references":[{"url":"https://github.com/craftcms/cms","label":"7004884b-51e2-48e8-b4a2-5ca29e80453e"},{"url":"https://github.com/craftcms/cms/releases/tag/5.10.6","label":"7004884b-51e2-48e8-b4a2-5ca29e80453e"},{"url":"https://www.hckrt.com/hacktivity/HCKRT-JD662P","label":"7004884b-51e2-48e8-b4a2-5ca29e80453e"}],"tags":["nvd"],"epss":0.0102,"epssPercentile":0.62404,"ingestedAt":"2026-10-12T15:55:08.124Z","slug":"CVE-2026-78416","body":"## Overview\n\nCraft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}