AIKIDO-2026-963052

TL;DR

EagerLoadPlan::$when accepts any PHP callable without restricting it to a Closure, and eager-load criteria reach it after sanitization that only strips on /as prefixed keys. A control panel user with only the accessCp permission can submit an eager-load when value such as system through the element search criteria, which is later invoked as a callback and executes operating system commands as the PHP web worker. The fix restricts $when to a Closure.