Executive brief
Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape
Affected products
- Packagist craftcms/cms
Junglewise Threat Intelligence
Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape
Severity: low · CVSS 3.1 · Published 2026-08-11
Technologies: craftcms/cms (Packagist). Vendors: Packagist.
Related threats
- Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal
- Craft CMS authorization bypass in category structure modification
- Craft CMS authenticated RCE through Twig sandbox escape
- Craft CMS path traversal in ensurePathIsContained
- Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables