Executive brief
Craft CMS is a content management platform used to build and manage websites and digital experiences. A vulnerability in its Twig template sandbox allows authenticated users to execute arbitrary code on the server by leveraging dangerous Yii framework functionality that should have been blocked. This could lead to complete server compromise and data theft for any administrator or user with template editing privileges.
Technical details
The vulnerability is an authentication-required remote code execution (RCE) vulnerability in Craft CMS arising from misconfiguration of the Twig sandbox security policy. The sandbox is intended to restrict dangerous operations in user-supplied templates, but it is configured to allow access to dangerous methods from the underlying Yii framework. An authenticated attacker with template editing or execution capabilities can craft malicious Twig templates that invoke these Yii framework methods to achieve arbitrary code execution. The attack vector is template injection through the Twig templating engine, and exploitation requires authentication. Fix availability and specific impacted versions are not detailed in the provided advisory text.
Affected products
- Craft CMS
Timeline
- 2026-08-27: disclosed