# CVE-2026-105985: Craft CMS authenticated remote code execution in Control Panel

Source: https://junglewise.ai/threats/cve-2026-105985-craft-cms-5-10-13-2-contains-an-authenticated-remote-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-105985 · Severity: high · CVSS 8.8 · Published 2026-10-06

Craft CMS is a content management system that manages website content and user roles. An authenticated attacker with basic Control Panel access can inject malicious Twig code through component overrides that gets executed server-side without sandboxing, allowing them to run arbitrary operating-system commands with the privileges of the web server process.

Technologies: [Craft CMS](https://junglewise.ai/threats/technologies/craft-cms-1). Vendors: [Craft](https://junglewise.ai/threats/vendors/craft).

## Quick answers

**Is CVE-2026-105985 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105985 being exploited in the wild.

**How severe is CVE-2026-105985?** High severity, with a CVSS score of 8.8, published 6 October 2026.

**Which products and versions are affected?** Craft CMS 5.10.13.2.

**Is there a fix for CVE-2026-105985?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105985 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105985?** Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authenticated remote code execution vulnerability exists in Craft CMS 5.10.13.2's Control Panel render-components action. The vulnerability allows any authenticated user to override component classes and EntryType properties such as uiLabelFormat, which are then evaluated as unsandboxed Twig templates. An attacker can invoke PHP functions like system() through Twig callable strings, achieving arbitrary command execution.

## Affected products

- Craft CMS 5.10.13.2

## Timeline

- 2026-10-06: disclosed

## References

- [https://packagist.org/](https://packagist.org/)
- [https://github.com/craftcms/cms](https://github.com/craftcms/cms)

## Related threats

- [Craft CMS SQL injection in craft.search](https://junglewise.ai/threats/cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of)
- [Craft CMS authorization bypass in volume browser](https://junglewise.ai/threats/cve-2026-124431-craft-cms-from-5-10-0-before-5-11-2-contains-an-authorization)
- [Craft CMS privilege escalation in public registration](https://junglewise.ai/threats/cve-2026-124429-craft-cms-from-5-0-0-before-5-11-2-contains-a-privilege)
- [Craft CMS path traversal in app/icon-svg endpoint](https://junglewise.ai/threats/cve-2026-124428-craft-cms-from-5-7-0-before-5-11-2-contains-an-arbitrary-file)
- [Craft CMS authorization bypass in GraphQL schema scope](https://junglewise.ai/threats/cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization)