Executive brief
Craft CMS is a web content management system that allows administrators to design and manage site content using templating logic. In affected versions, authenticated users with control panel access can exploit a flaw in the Twig template sandbox feature to execute arbitrary code on the server, bypassing the sandbox protections designed to prevent such attacks. This could allow a compromised or malicious admin to take full control of the web server and underlying infrastructure.
Technical details
The vulnerability is a sandbox escape in Craft CMS's Twig security policy implementation. The SecurityPolicy class marks the ElementInterface as safe via the AllowedInSandbox attribute, but the allowlist mechanism incorrectly extends to the entire class hierarchy, including yii\base\Component from the underlying Yii framework. This component contains a known arbitrary function-call gadget that has been exploited in previous Craft CMS RCE vulnerabilities (GHSA-255j-qw47-wjh5, GHSA-2fph-6v5w-89hh, GHSA-7jx7-3846-m7w7, GHSA-qrgm-p9w5-rrfw). An authenticated attacker with control panel access can craft a malicious Twig template that uses this gadget to achieve RCE, even when the Twig sandbox is explicitly enabled via enableTwigSandbox(). The fix involves restricting the allowlist to prevent access to dangerous base class methods and properties. Patches are available in versions 5.10.7 and 4.18.3.
Affected products
- Craft CMS >= 5.0.0-RC1 before 5.10.7; >= 4.0.0-RC1 before 4.18.3
Timeline
- 2026-07-25: disclosed: GitHub Security Advisory GHSA-f5wm-88jv-g5hx published
- 2026-08-11: advisory: NVD entry published
- 2026-08-11: patched: Patches available: CMS 5.10.7 and 4.18.3