A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

ElementSearchController::actionSearch() accepts criteria.with[*].when from request JSON. Both request-cleansing functions preserve this value, Craft copies it into EagerLoadPlan::$when, and array_filter() invokes it as a PHP callback. Setting when to system and placing a command in the attacker’s own fullName causes the effective call system((string)$currentUser).

The exploit does not require administrator rights, user management permissions, an elevated session, Dev Mode, disabled Twig sandboxing, plugins, victim interaction, or an unusual database state.

Prerequisite

The attacker needs a remote authenticated, non-admin Control Panel account with accessCp permissions. The tested account has admin=false, zero direct permissions, and only group-derived accessCp. It cannot manage other users or change system settings.

This is a separate sibling vulnerability, not a bypass of the CVE-2026-44011 patch. Both issues are reachable through /admin/actions/element-search/search, but CVE-2026-44011 used request-controlled condition.fieldLayouts to inject Yii as and on behavior/event configuration because condition hydration lacked Component::cleanseConfig(). Its Craft 5.9.18 fix added that cleansing boundary, and the tested 5.10.11 code contains that fix.

This report uses the separate criteria.with[*].when branch. The value already passes through both request cleansers, but neither recognizes its callable semantics. Craft copies it to EagerLoadPlan::$when and invokes it directly through array_filter(). No Yii behavior or event injection is involved, so the earlier patch does not address this callback sink.

Successful exploitation grants the attacker arbitrary execution of operating-system commands with the Craft PHP worker’s privileges.

This permits access to application secrets, environment and database credentials, CMS content, and files readable by the PHP process; modification of content and writable application/runtime files; and disruption of the Craft service. The vulnerability does not by itself grant root privileges or imply a container escape.