THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-265m-7826-wjqm (high) — Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

[GHSA] GHSA-265m-7826-wjqm (high) — Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

medgithub_advisoriesPublished 2026-08-06

GHSA-265m-7826-wjqm Severity: high CVE: None

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling.

Craft cleans the outer request-controlled condition array with `Component::cleanseConfig()`, but `Conditions::createCondition()` later decodes and merges the JSON st

MITRE ATT&CK techniques

Control PanelT1218.002
CredentialsT1589.001

Original source: https://github.com/advisories/GHSA-265m-7826-wjqm