CVE-2026-78416

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78416", "assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "state": "PUBLISHED", "assignerShortName": "Hackrate", "dateReserved": "2026-08-24T15:07:04.075Z", "datePublished": "2026-08-24T15:36:07.971Z", "dateUpdated": "2026-08-26T20:59:03.683Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "shortName": "Hackrate", "dateUpdated": "2026-08-26T20:59:03.683Z"}, "title": "Authenticated RCE via `condition.config` JSON cleanse bypass", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-915", "description": "CWE-915 Improperly controlled modification of Dynamically-Determined object attributes", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "craftcms", "product": "cms", "collectionURL": "https://packagist.org", "packageName": "craftcms/cms", "versions": [{"status": "affected", "version": "4.0.0-RC1", "lessThan": "4.18.2", "versionType": "semver"}, {"status": "affected", "version": "5.0.0-RC1", "lessThan": "5.10.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0-rc1", "versionEndExcluding": "4.18.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0-rc1", "versionEndExcluding": "5.10.6"}]}]}], "descriptions": [{"lang": "en", "value": "Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.<br>"}]}], "references": [{"url": "https://www.hckrt.com/hacktivity/HCKRT-JD662P", "tags": ["third-party-advisory", "technical-description", "mitigation"]}, {"url": "https://github.com/craftcms/cms/releases/tag/5.10.6", "tags": ["release-notes"]}, {"url": "https://github.com/craftcms/cms", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "saladin", "type": "reporter"}, {"lang": "en", "value": "Hackrate", "type": "coordinator"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-78416"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T03:56:39.218Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78416", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T15:53:56.202088Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T15:55:22.303Z"}}], "cna": {"title": "Authenticated RCE via `condition.config` JSON cleanse bypass", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "saladin"}, {"lang": "en", "type": "coordinator", "value": "Hackrate"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": "4.0.0-RC1", "lessThan": "4.18.2", "versionType": "semver"}, {"status": "affected", "version": "5.0.0-RC1", "lessThan": "5.10.6", "versionType": "semver"}], "packageName": "craftcms/cms", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://www.hckrt.com/hacktivity/HCKRT-JD662P", "tags": ["third-party-advisory", "technical-description", "mitigation"]}, {"url": "https://github.com/craftcms/cms/releases/tag/5.10.6", "tags": ["release-notes"]}, {"url": "https://github.com/craftcms/cms", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.", "supportingMedia": [{"type": "text/html", "value": "Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "CWE-915 Improperly controlled modification of Dynamically-Determined object attributes"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.18.2", "versionStartIncluding": "4.0.0-rc1"}, {"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.6", "versionStartIncluding": "5.0.0-rc1"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "shortName": "Hackrate", "dateUpdated": "2026-08-26T20:59:03.683Z"}}}, "cveMetadata": {"cveId": "CVE-2026-78416", "state": "PUBLISHED", "dateUpdated": "2026-08-26T20:59:03.683Z", "dateReserved": "2026-08-24T15:07:04.075Z", "assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "datePublished": "2026-08-24T15:36:07.971Z", "assignerShortName": "Hackrate"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "packageName": "craftcms/cms", "product": "cms", "vendor": "craftcms", "versions": [{"lessThan": "4.18.2", "status": "affected", "version": "4.0.0-RC1", "versionType": "semver"}, {"lessThan": "5.10.6", "status": "affected", "version": "5.0.0-RC1", "versionType": "semver"}]}], "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user."}, {"lang": "es", "value": "Las versiones de Craft CMS desde la 4.0.0-RC1 anteriores a la 4.18.2 y desde la 5.0.0-RC1 anteriores a la 5.10.6 contienen una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo autenticada en el manejo de condiciones de b\u00fasqueda de elementos del panel de control. Una omisi\u00f3n de limpieza JSON en condition.config permite que las claves de configuraci\u00f3n de comportamiento/evento de Yii sean interpretadas despu\u00e9s de la decodificaci\u00f3n, lo que permite la ejecuci\u00f3n de comandos como el usuario PHP/web."}], "id": "CVE-2026-78416", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78416", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-08-24T16:17:24.250", "references": [{"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://github.com/craftcms/cms"}, {"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://github.com/craftcms/cms/releases/tag/5.10.6"}, {"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://www.hckrt.com/hacktivity/HCKRT-JD662P"}], "sourceIdentifier": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-915"}], "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0-RC1,4.18.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0-RC1,5.10.6)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "craftcms"}, "product": "cms", "vendor": "craftcms"}], "created": "2026-08-24T18:00:04.951170+00:00", "updated": "2026-08-24T20:00:04.390222+00:00", "vendors": ["craftcms", "craftcms$PRODUCT$cms"]}