CVE-2026-78416
Description
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.
Is your site exposed to CVE-2026-78416?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-78416? +
How do I check if I'm vulnerable to CVE-2026-78416? +
Related Vulnerabilities
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …
9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …