HIGH 8.7 NVD

CVE-2026-78416

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel e

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.

References

https://github.com/craftcms/cms/releases/tag/5.10.6
https://www.hckrt.com/hacktivity/HCKRT-JD662P

Published: 2026-08-24 · Source: NVD · Feed updated: 2026-08-24

This high severity vulnerability with a CVSS score of 8.7 was published on 2026-08-24 via NVD.

vulnfeed aggregates 11251 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.