Craft CMS implements a control panel element‑search feature that accepts a JSON string in the condition.config field. When a request is made, the outer array is cleansed by Component::cleanseConfig, but the decoded JSON string is later merged without a second cleanse. Yii then interprets special config keys such as 'as …' and 'on …' as behavior or event attachments during FieldLayout creation. An authenticated attacker who can forge a valid CSRF token is able to inject malicious Yii configuration, cause the system to execute arbitrary operating system commands as the PHP/web user, and therefore obtain full control of the hosting environment. This flaw is identified as CWE‑915, a time‑of‑check-to-time‑of‑use vulnerability, and its impact is the highest, potentially compromising data integrity, confidentiality, and availability.

The flaw affects Craft CMS released by CraftCMS. All versions starting with 4.0.0‑RC1 and up to but not including 4.18.2, and all versions starting with 5.0.0‑RC1 up to but not including 5.10.6, are vulnerable. Deployments of any of these releases are at risk until the organization applies the first available patch level. The affected product is Craft CMS, and the vendor is CraftCMS.

The CVSS score of 8.7 indicates severe risk. No EPSS score or KEV listing has been reported, implying that exploitation has not yet been observed in the wild but remains technically feasible. The vulnerability requires an authenticated control‑panel session and a valid CSRF token, so the attack surface is limited to privileged users or attackers who acquire such credentials through phishing or credential compromise. Once authenticated, the attacker can execute arbitrary commands as the web server’s user, fully compromising the host. Given the lack of public exploitation data but the high impact, the overall risk remains high until a vendor patch is applied.