CVE-2026-72778-craftcms-rce

CVE-2026-72778 — Craft CMS condition.config RCE Craft cleanses the outer condition configuration but subsequently JSON-decodes and merges condition.config without re-cleansing it. Yii behavior/event keys hidden in that string therefore reach FieldLayout object creation and execute a command gadge...