A critical remote command execution vulnerability in Craft CMS allows authenticated, low-privilege users to execute arbitrary system commands as the PHP web worker.

This vulnerability is an OS command injection flaw (CWE-470) triggered through unsafe reflection in the ElementSearchController::actionSearch function. An attacker with minimal access (specifically the accessCp permission) can manipulate the criteria.with[*].when parameter to invoke PHP callback functions, ultimately leading to system command execution.

Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the PHP web worker process. This can lead to full compromise of the application, including access to database credentials, environment secrets, and sensitive CMS content. Given the CVSS score of 8.8, this vulnerability poses a high risk to organizational data integrity and service availability.

Immediate Action: Update Craft CMS to version 5.10.13 or later immediately to incorporate the security fix provided by the vendor.

Proactive Monitoring: Review web server and application access logs for suspicious requests directed at /admin/actions/element-search/search, particularly those containing unexpected JSON payloads or callback-related parameters.

Compensating Controls: Implement strict network segmentation and ensure the web worker process runs with the least privilege possible to minimize the impact of potential command execution.

Public Exploit Available: No (The provided research writeup details the mechanism, but no weaponized exploit or public PoC repository was identified).

This vulnerability represents a significant security risk due to the potential for full system compromise from a low-privilege account. Organizations utilizing Craft CMS should prioritize the update to version 5.10.13 across all environments. Failure to patch may allow unauthorized actors to gain persistent access to the server infrastructure and underlying application data.