Junglewise Threat Intelligence

Craft CMS Twig sandbox escape leading to authenticated RCE

Severity: high · CVSS 8.7 · Published 2026-08-06

Executive brief

Craft CMS, a popular content management system, contains a vulnerability that allows an authorized user with control panel access to bypass security restrictions. By exploiting a flaw in how the system handles custom templates, an attacker can execute unauthorized commands on the underlying server. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of business operations.

Technical details

Craft CMS is vulnerable to a Twig sandbox escape leading to Remote Code Execution (RCE). The vulnerability stems from a lax implementation of Twig's `SecurityPolicyInterface`, which allows methods and properties from the entire class hierarchy of an allowlisted class to be executed. Specifically, the `ElementInterface` is marked as safe via the `AllowedInSandbox` attribute; however, the `Element` class inherits from `yii\base\Component`, which contains a known arbitrary function-call gadget. An authenticated attacker with control panel access can render a malicious Twig template to trigger this gadget and execute arbitrary code. The issue is addressed in Craft CMS versions 4.18.3 and 5.10.7.

Affected products

  • Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.18.3; >= 5.0.0-RC1, < 5.10.7

Timeline

  • 2026-07-25: disclosed: Advisory published by angrybrad
  • 2026-08-06: advisory: GitHub Advisory Database entry reviewed and updated
  • 2026-06-18: patched: Versions 4.18.3 and 5.10.7 released

References