---
id: CVE-2026-78416
title: >-
  Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before
  5.10.6 contain an authenticated remote code execution vulnerability in control
  panel element-search condition handling
summary: >-
  Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before
  5.10.6 contain an authenticated remote code execution vulnerability in control
  panel element-search condition handling. A JSON cleanse bypass in
  condition.config a…
severity: none
cwe:
  - CWE-915
published: '2026-08-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78416'
references:
  - url: 'https://github.com/craftcms/cms'
    label: 7004884b-51e2-48e8-b4a2-5ca29e80453e
  - url: 'https://github.com/craftcms/cms/releases/tag/5.10.6'
    label: 7004884b-51e2-48e8-b4a2-5ca29e80453e
  - url: 'https://www.hckrt.com/hacktivity/HCKRT-JD662P'
    label: 7004884b-51e2-48e8-b4a2-5ca29e80453e
tags:
  - nvd
epss: 0.0102
epssPercentile: 0.62404
ingestedAt: '2026-10-12T15:55:08.124Z'
---

## Overview

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.