GHSA-W36C-QXRQ-V7FW高危已审查已撤回

Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

OSV 1.4.0 · github-reviewed · 修改于 2026-09-02 05:07

发布时间

2026-08-11 23:32

GitHub 审查时间

2026-09-02 05:07

NVD 发布时间

2026-08-11 21:19

源文件

advisories/github-reviewed/2026/08/GHSA-w36c-qxrq-v7fw/GHSA-w36c-qxrq-v7fw.json

该公告已于 2026-09-02 05:07 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-265m-7826-wjqm. This link is maintained to preserve external references.

Original Description

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as 'as ...' and 'on ...' can be hidden inside it and, after JSON decoding, are interpreted by Yii as behavior/event configuration during FieldLayout object creation. An attacker with an authenticated control panel session (and a valid CSRF token) can exploit this to execute operating system commands as the PHP/web user.

受影响的软件包

Packagist

craftcms/cms

标识信息

别名 / CVE

无

CWE

CWE-915

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

原始 OSV JSON

{
  "id": "GHSA-w36c-qxrq-v7fw",
  "aliases": [],
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-265m-7826-wjqm. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as 'as ...' and 'on ...' can be hidden inside it and, after JSON decoding, are interpreted by Yii as behavior/event configuration during FieldLayout object creation. An attacker with an authenticated control panel session (and a valid CSRF token) can exploit this to execute operating system commands as the PHP/web user.",
  "summary": "Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "4.0.0-RC1"
            }
          ]
        }
      ],
      "package": {
        "name": "craftcms/cms",
        "ecosystem": "Packagist"
      },
      "database_specific": {
        "last_known_affected_version_range": "< 4.18.2"
      }
    }
  ],
  "modified": "2026-09-01T21:07:05Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  ],
  "published": "2026-08-11T15:32:38Z",
  "withdrawn": "2026-09-01T21:07:05Z",
  "references": [
    {
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-265m-7826-wjqm",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72778",
      "type": "ADVISORY"
    },
    {
      "url": "https://www.vulncheck.com/advisories/craft-cms-rc1-before-authenticated-rce-via-condition-config",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2026-08-11T13:19:08Z",
    "github_reviewed_at": "2026-09-01T21:07:05Z"
  }
}