Zaloguj się
Deutsch English Español Polski
Wysoka

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

  • Ujawniono: 06.08.2026
  • Aktualizacja: 11.10.2026 10:22

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling.

Craft cleans the outer request-controlled condition array with Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded/merged configuration.

Because condition.config is a JSON string during the first cleanse, Yii special config keys such as as ... and on ... can be hidden inside it. After JSON decoding, those keys reach FieldLayout object creation and are interpreted by Yii as behavior/event configuration.

The RCE is semi-blind: the trigger endpoint returns a normal JSON response, and the command output is verified via a server-side file-write side effect retrieved in a subsequent request.

Preconditions

  • The attacker needs an authenticated Craft control panel session.
  • A valid CSRF token is required.

Impact

An authenticated control panel user can inject Yii behavior/event configuration after Craft’s intended config cleanse boundary. In the confirmed local lab, this led to command execution as the PHP/web user.

Potential attacker impact:

  • Execute operating system commands as the PHP/web user.
  • Read Craft secrets, environment variables, and application configuration.
  • Access database credentials and stored site content.
  • Modify site content, users, and application state.
  • Pivot to internal services reachable from the Craft host or container.
  • Cause denial of service or establish persistence depending on deployment permissions.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka Composer craftcms/cms >= 5.0.0-RC1, < 5.10.6, >= 4.0.0-RC1, < 4.18.2 5.10.6, 4.18.2

Odnośniki

Ocena CVSS -
Wektor CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Słabość (CWE)
CWE-915
Platforma
Composer
Paczka
craftcms/cms
Ujawniono
06.08.2026
Aktualizacja
11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-265m-7826-wjqm - CC BY 4.0

Historia podatności: craftcms/cms

Wszystkie opisane podatności tej paczki (Paczka Composer), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (127) w archiwum
Wszystkich wpisów
127
Pierwsza → ostatnia
07.2021 08.2026
Bez poprawki
6
Wykorzystywana w atakach
4

Rozkład istotności

  • Krytyczna 9
  • Wysoka 41
  • Średnia 65
  • Niska 12

Ujawnienia w latach

Istotność:
  1. Craft CMS: Passkey login accepts replayed WebAuthn assertions
    Krytyczna CVE-2026-72780 >= 5.0.0-RC1, < 5.10.5 5.10.5
  2. Craft CMS: Arbitrary user password reset leading to administrator account takeover
    Wysoka CVE-2026-72786 >= 5.0.0-RC1, < 5.10.8 5.10.8
  3. Craft CMS: Authenticated RCE through Twig sandbox escape
    Wysoka CVE-2026-72781 >= 5.0.0-RC1, < 5.10.7, >= 4.0.0-RC1, < 4.18.3 5.10.7, 4.18.3
  4. Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass ten wpis
    Wysoka CVE-2026-72778 >= 5.0.0-RC1, < 5.10.6, >= 4.0.0-RC1, < 4.18.2 5.10.6, 4.18.2
  5. Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
    Wysoka CVE-2026-56382 >= 5.5.0, < 5.9.14 5.9.14
  6. Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
    Wysoka CVE-2026-55794 >= 5.9.0, < 5.10.0 5.10.0
  7. Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
    Wysoka CVE-2026-55790 >= 5.0.0-RC1, < 5.9.23, >= 4.0.0-RC1, < 4.17.16 5.9.23, 4.17.16
  8. Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
    Wysoka CVE-2026-50282 >= 5.0.0-RC1, < 5.9.21, >= 4.0.0-RC1, < 4.17.14 5.9.21, 4.17.14
  9. Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
    Wysoka CVE-2026-50281 >= 5.7.0, < 5.9.21 5.9.21
  10. Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
    Wysoka CVE-2026-50284 >= 5.0.0-RC1, < 5.9.22, >= 4.0.0-RC1, < 4.17.15 5.9.22, 4.17.15
  11. Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
    Wysoka CVE-2026-50279 >= 5.0.0-RC1, < 5.9.21 5.9.21
  12. Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
    Krytyczna CVE-2026-55791 >= 5.0.0-RC1, < 5.10, >= 4.0.0-RC1, < 4.18 5.10, 4.18
  13. Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
    Wysoka CVE-2026-44012 >= 5.0.0-RC1, < 5.9.18 5.9.18
  14. Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
    Wysoka CVE-2026-44011 >= 4.0.0, < 4.17.12, >= 5.0.0, < 5.9.18 4.17.12, 5.9.18
  15. Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
    Wysoka CVE-2026-44010 >= 5.0.0, < 5.9.18, >= 4.0.0, < 4.17.12 5.9.18, 4.17.12
  16. Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
    Wysoka CVE-2026-33157 >= 5.6.0, < 5.9.13 5.9.13
  17. Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
    Wysoka CVE-2026-32267 >= 4.0.0-RC1, < 4.17.6, >= 5.0.0-RC1, < 5.9.12 4.17.6, 5.9.12
  18. Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
    Wysoka CVE-2026-32264 >= 4.0.0-RC1, < 4.17.5, >= 5.0.0-RC1, < 5.9.11 4.17.5, 5.9.11
  19. Craft CMS vulnerable to behavior injection RCE via EntryTypesController
    Wysoka CVE-2026-32263 >= 5.6.0, < 5.9.11 5.9.11
  20. CraftCMS has an RCE vulnerability via relational conditionals in the control panel
    Wysoka CVE-2026-31857 >= 5.0.0-RC1, < 5.9.9, >= 4.0.0-beta.1, < 4.17.4 5.9.9, 4.17.4
  21. CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
    Wysoka CVE-2026-31858 >= 5.0.0-RC1, < 5.9.9 5.9.9
  22. Craft CMS has unauthenticated activation email trigger with potential user enumeration
    Wysoka CVE-2026-29069 >= 5.0.0-RC1, < 5.9.0-beta.2, >= 4.0.0-RC1, < 4.17.0-beta.2 5.9.0-beta.2, 4.17.0-beta.2
  23. Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
    Krytyczna CVE-2026-28697 >= 5.0.0-RC1, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1 5.9.0-beta.1, 4.17.0-beta.1
  24. Craft CMS has IDOR via GraphQL @parseRefs
    Wysoka CVE-2026-28696 >= 4.0.0-RC1, < 4.17.0-beta.1, >= 5.0.0-RC1, < 5.9.0-beta.1 4.17.0-beta.1, 5.9.0-beta.1
  25. Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
    Wysoka CVE-2026-27127 >= 5.0.0-RC1, < 5.8.23, >= 3.5.0, < 4.16.19 5.8.23, 4.16.19
  26. Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
    Wysoka CVE-2026-25498 >= 5.0.0-RC1, < 5.8.22, >= 4.0.0-RC1, < 4.16.18 5.8.22, 4.16.18
  27. Craft CMS: GraphQL Asset Mutation Privilege Escalation
    Wysoka CVE-2026-25497 >= 5.0.0-RC1, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1 5.9.0-beta.1, 4.17.0-beta.1
  28. Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
    Wysoka CVE-2026-25495 >= 5.0.0-RC1, < 5.8.22, >= 4.0.0-RC1, < 4.16.18 5.8.22, 4.16.18
  29. Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
    Wysoka CVE-2025-68455 >= 5.0.0-RC1, < 5.8.21, >= 4.0.0-RC1, < 4.16.17 5.8.21, 4.16.17
  30. Unauthenticated Craft CMS users can trigger a database backup
    Wysoka CVE-2025-68456 >= 5.0.0-RC1, < 5.8.21, >= 3.0.0, < 4.16.17 5.8.21, 4.16.17
  31. Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
    Wysoka CVE-2025-46731 >= 4.0.0-RC1, < 4.14.13, >= 5.0.0-RC1, < 5.6.15 4.14.13, 5.6.15
  32. Craft CMS Allows Remote Code Execution
    Krytyczna · 10.0 Wykorzystywana w atakach CVE-2025-32432 >= 3.0.0-RC1, < 3.9.15, >= 4.0.0-RC1, < 4.14.15, >= 5.0.0-RC1, < 5.6.17 3.9.15, 4.14.15, 5.6.17
  33. Craft CMS has a potential RCE with a compromised security key
    Wysoka · 8.0 Wykorzystywana w atakach CVE-2025-23209 >= 5.0.0-RC1, < 5.5.8, >= 4.0.0-RC1, < 4.13.8 5.5.8, 4.13.8
  34. Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
    Krytyczna · 9.8 Wykorzystywana w atakach CVE-2024-56145 >= 5.0.0-RC1, < 5.5.2, >= 4.0.0-RC1, < 4.13.2, >= 3.0.0, < 3.9.14 5.5.2, 4.13.2, 3.9.14
  35. Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
    Wysoka · 7.2 CVE-2024-52293 >= 4.0.0-RC1, < 4.12.2, >= 5.0.0-RC1, < 5.4.3 4.12.2, 5.4.3
  36. Craft CMS Arbitrary System File Read
    Wysoka · 7.7 CVE-2024-52292 >= 5.0.0-alpha.1, < 5.4.9, >= 3.5.13, < 4.12.8 5.4.9, 4.12.8
  37. Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
    Wysoka · 8.4 CVE-2024-52291 >= 5.0.0-RC1, < 5.4.6, >= 4.0.0-RC1, < 4.12.5 5.4.6, 4.12.5
  38. Craft CMS SQL injection vulnerability via the GraphQL API endpoint
    Krytyczna · 9.8 CVE-2024-37843 <= 3.7.31 brak poprawki
  39. Craft CMS Feed-Me
    Wysoka · 7.5 CVE-2023-36260 < 4.6.2 4.6.2
  40. Craft CMS Remote Code Execution vulnerability
    Krytyczna · 10.0 CVE-2023-41892 >= 4.0.0-RC1, < 4.4.15 4.4.15
Pokaż więcej (10) Widać 40 z 50

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.