Craft CMS 5.10.13.2 contains an authenticated remote code execution flaw in the Control Panel action app/render-components. Any user with basic Control Panel access can submit request‑controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request‑cached entry type, an attacker can inject arbitrary Twig code that is evaluated by renderObjectTemplate(). This path is not sandboxed; a Twig string callable can call PHP functions such as system(), allowing operating‑system command execution with the privileges of the PHP/web‑server process.

Craft CMS, released by craftcms, is affected by this vulnerability. Versions up to and including 5.10.13.2 are vulnerable; upgrading to 5.11.0 or later removes the flaw. The issue was reproduced with a non‑admin Craft Team member who had basic Control Panel access and no optional permissions.

The vulnerability carries a high CVSS score of 8.7 and is not listed in the CISA KEV catalog. An EPSS score is not available, suggesting limited public exploitation data. Because the flaw requires authenticated access, the attack surface is restricted to users with Control Panel permissions. Attackers with such access can execute arbitrary system commands, potentially compromising the entire server environment.