https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 16:45:29 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-72778 <p>Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as &#39;as ...&#39; and &#39;on ...&#39; can be hidden inside it and, after JSON decoding, are interpreted by Yii as behavior/event configuration during FieldLayout object creation. An attacker with an authenticated control panel session (and a valid CSRF token) can exploit this to execute operating system commands as the PHP/web user.</p> <p>Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as &#39;as ...&#39; and &#39;on ...&#39; can be hidden inside it and, after JSON decoding, are interpreted by Yii as behavior/event configuration during FieldLayout object creation. An attacker with an authenticated control panel session (and a valid CSRF token) can exploit this to execute operating system commands as the PHP/web user.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-72778 https://vulnerability.circl.lu/vuln/ghsa-265m-7826-wjqm <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling.</p> <p>Craft cleans the outer request-controlled condition array with `Component::cleanseConfig()`, but `Conditions::createCondition()` later decodes and merges the JSON string in `condition.config` without re-running `cleanseConfig()` on the decoded/merged configuration.</p> <p>Because `condition.config` is a JSON string during the first cleanse, Yii special config keys such as `as` ... and `on` ... can be hidden inside it. After JSON decoding, those keys reach FieldLayout object creation and are interpreted by Yii as behavior/event configuration.</p> <p>The RCE is semi-blind: the trigger endpoint returns a normal JSON response, and the command output is verified via a server-side file-write side effect retrieved in a subsequent request.</p> <p>## Preconditions</p> <p>- The attacker needs an authenticated Craft control panel session. - A valid CSRF token is required.</p> <p>## Impact</p> <p>An authenticated control panel user can inject Yii behavior/event configuration after Craft’s intended config cleanse boundary. In the confirmed local lab, this led to command execution as the PHP/web user.</p> <p>Potential attacker impact: - Execute operating system commands as the PHP/web user. - Read Craft secrets, environment variables, and application configuration. - Access database credentials and stored site content. - Modify site content, users, and application state. - Pivot to internal services reachable from t…</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling.</p> <p>Craft cleans the outer request-controlled condition array with `Component::cleanseConfig()`, but `Conditions::createCondition()` later decodes and merges the JSON string in `condition.config` without re-running `cleanseConfig()` on the decoded/merged configuration.</p> <p>Because `condition.config` is a JSON string during the first cleanse, Yii special config keys such as `as` ... and `on` ... can be hidden inside it. After JSON decoding, those keys reach FieldLayout object creation and are interpreted by Yii as behavior/event configuration.</p> <p>The RCE is semi-blind: the trigger endpoint returns a normal JSON response, and the command output is verified via a server-side file-write side effect retrieved in a subsequent request.</p> <p>## Preconditions</p> <p>- The attacker needs an authenticated Craft control panel session. - A valid CSRF token is required.</p> <p>## Impact</p> <p>An authenticated control panel user can inject Yii behavior/event configuration after Craft’s intended config cleanse boundary. In the confirmed local lab, this led to command execution as the PHP/web user.</p> <p>Potential attacker impact: - Execute operating system commands as the PHP/web user. - Read Craft secrets, environment variables, and application configuration. - Access database credentials and stored site content. - Modify site content, users, and application state. - Pivot to internal services reachable from t…</p> https://vulnerability.circl.lu/vuln/ghsa-265m-7826-wjqm