SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-78416

HIGH · CVSS 8.7 EPSS 0.61% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-24 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

Craft CMS versions prior to 4.18.2 and 5.10.6 are vulnerable to an authenticated remote code execution flaw due to a JSON cleanse bypass in the control panel's element-search condition handling. This vulnerability allows attackers to execute arbitrary commands with the privileges of the PHP/web user, potentially compromising the entire application. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution
GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-78416
Severity
HIGH
CVSS
8.7
EPSS
0.61%

Original NVD Description

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.