Is CVE-2026-109305 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109305 being exploited in the wild.

How severe is CVE-2026-109305?

High severity, with a CVSS score of 8.8, published 12 October 2026.

Which products and versions are affected?

Craft CMS 5.10.2 through 5.10.13.

How is CVE-2026-109305 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109305?

Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109305: Craft CMS Twig sandbox bypass in "has some"/"has every" operators

CVE-2026-109305 · Severity: high · CVSS 8.8 · Published 2026-10-12

Craft CMS is a content management system that allows administrators to delegate permissions to non-admin users, including the ability to write templates. A flaw in how Craft handles sandboxed templates allows users with the System Messages permission to execute arbitrary PHP code with the privileges of the web server. This enables privilege escalation from a delegated permission to full code execution on the server.

Technologies: Craft CMS. Vendors: Craft.

Quick answers

Is CVE-2026-109305 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109305 being exploited in the wild.
How severe is CVE-2026-109305?: High severity, with a CVSS score of 8.8, published 12 October 2026.
Which products and versions are affected?: Craft CMS 5.10.2 through 5.10.13.
Is there a fix for CVE-2026-109305?: Yes: fixed in 5.10.14. Until then: Disable the enableTwigSandbox configuration setting if sandboxed templates are not in use. Sites that require the sandbox should upgrade to version 5.10.14 immediately. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109305 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109305?: Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.10.14

Disable the enableTwigSandbox configuration setting if sandboxed templates are not in use. Sites that require the sandbox should upgrade to version 5.10.14 immediately.

Technical details

The vulnerability is a regression in the Twig sandbox enforcement introduced by an upgrade to Twig 3.26. The sandbox bypass occurs in the "has some" and "has every" operators, which pass a hardcoded $isSandboxed=false parameter to checkArrow() instead of the current sandbox state. This allows a sandboxed template author to invoke arbitrary two-argument PHP callables (such as passthru, system, file_put_contents) with attacker-controlled arguments. The attack requires enableTwigSandbox to be enabled and the attacker to possess the System Messages permission or equivalent ability to author sandboxed templates.

Affected products

Craft CMS 5.10.2 through 5.10.13

Timeline

2026-09-22: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.