CVE-2026-78416: Craft CMS CMS

High severity, CVSS 8.7. EPSS: 1% chance of exploitation in the next 30 days.

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.

Affected products

• Craft CMS CMS: from 4.0.0-RC1, before 4.18.2 (fixed in 4.18.2); from 5.0.0-RC1, before 5.10.6 (fixed in 5.10.6)

Published 2026-08-24. Last modified 2026-08-28.