Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling.

Craft cleans the outer request-controlled condition array with Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded/merged configuration.

Because condition.config is a JSON string during the first cleanse, Yii special config keys such as as ... and on ... can be hidden inside it. After JSON decoding, those keys reach FieldLayout object creation and are interpreted by Yii as behavior/event configuration.

Preconditions

• The attacker needs an authenticated Craft control panel session.
• A valid CSRF token is required. The token must be copied from the /admin/dashboard response body value named csrfTokenValue. The CRAFT_CSRF_TOKEN cookie value is not sufficient.

The cleanse bypass was confirmed with a non-executing canary.

Direct array payload:

condition[fieldLayouts][0][as directCanary][class]=NoSuch\CanaryBehavior

Result: HTTP 200, key stripped.

JSON-smuggled payload:

condition.config contains {"fieldLayouts":[{"as jsonCanary":{"class":"NoSuch\\CanaryBehavior"}}]}

Result: Yii behavior/config handling is reached.

This proves the issue is not just a random 500. The direct array is sanitized, while the JSON-decoded config bypasses the intended cleanse boundary.

This is semi-blind RCE. The vulnerable POST response does not return command output directly. The trigger response was a normal JSON response:

{"elements":[],"exactMatch":false}

No external callback, collaborator server, or reverse shell was used.

An authenticated control panel user can inject Yii behavior/event configuration after Craft’s intended config cleanse boundary. In the confirmed local lab, this led to command execution as the PHP/web user.

The demonstrated execution was semi-blind: the command output was not returned in the vulnerable endpoint response. Instead, the command wrote the output of id to a local webroot file, and the result was retrieved with a second HTTP request.

Potential attacker impact:

• Execute operating system commands as the PHP/web user.
• Read Craft secrets, environment variables, and application configuration.
• Access database credentials and stored site content.
• Modify site content, users, and application state.
• Pivot to internal services reachable from the Craft host or container.
• Cause denial of service or establish persistence depending on deployment permissions.