Executive brief
Craft CMS is a popular content management system used to build and manage websites. The vulnerability allows authenticated users with control panel access to execute arbitrary code on the server by crafting malicious Twig templates, even when security sandboxing is enabled. This could lead to complete server compromise, data theft, and website defacement.
Technical details
The vulnerability is a protection mechanism failure (CWE-693) in Craft CMS's Twig sandbox implementation. Craft marks ElementInterface as safe via the AllowedInSandbox attribute, and the sandbox allowlisting extends through the entire class hierarchy from craft\base\Component up to yii\base\Component. The yii\base\Component class contains a known arbitrary function-call gadget previously exploited in prior Craft CMS RCE vulnerabilities (GHSA-255j-qw47-wjh5, GHSA-2fph-6v5w-89hh, GHSA-7jx7-3846-m7w7, GHSA-qrgm-p9w5-rrfw). An authenticated attacker with permission to access the control panel can leverage this gadget to achieve RCE by rendering a malicious Twig template, bypassing the enableTwigSandbox() protection. Patches are available in versions 4.18.3 and 5.10.7.
Affected products
- Craft CMS Craft CMS >= 4.0.0-RC1, < 4.18.3
- Craft CMS Craft CMS >= 5.0.0-RC1, < 5.10.7
Timeline
- 2026-07-25: disclosed: Original advisory GHSA-f5wm-88jv-g5hx published
- 2026-08-11: advisory: Duplicate advisory GHSA-h784-hpjp-2rrm and CVE-2026-72781 published
- 2026-08-11: patched: Patches released: version 4.18.3 and 5.10.7
- 2026-09-01: other: Duplicate advisory GHSA-h784-hpjp-2rrm withdrawn