Description
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.
Published: 2026-10-12
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Craft CMS versions 5.10.2 through 5.10.13 contain a flaw in the Twig templating engine that allows non‑admin users with the System Messages permission to invoke PHP functions such as passthru or system through the "has some" and "has every" operators in sandboxed templates, thereby executing arbitrary shell commands on the web server as the web process.

Affected Systems

The flaw affects Craft CMS installations from the CraftCMS vendor running any version from 5.10.2 up to but not including 5.10.14. The issue was resolved in version 5.10.14 and onward.

Risk and Exploitability

The vulnerability scores a CVSS 8.7, indicating high severity, and is currently not listed in the CISA KEV catalog. No EPSS score is available, but the typical attack vector is through the Craft CMS web interface where a user or attacker who can create or edit system messages with sandboxed templates can trigger the callables. Consequently, the risk includes full remote code execution, compromising confidentiality, integrity, and availability of the affected site.

Generated by OpenCVE AI on October 12, 2026 at 18:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Craft CMS to version 5.10.14 or later to eliminate the sandbox bypass flaw.
  • Restrict the System Messages permission to administrative users only, ensuring that only trusted accounts can inject sandboxed template content.
  • If the Twig sandbox feature is not required, disable it or configure it to disallow callable execution within sandboxed templates.

Generated by OpenCVE AI on October 12, 2026 at 18:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Craftcms cms
Vendors & Products Craftcms cms

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.
Title Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
First Time appeared Craftcms
Craftcms craft Cms
Weaknesses CWE-1336
CPEs cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
Vendors & Products Craftcms
Craftcms craft Cms
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Craftcms Cms Craft Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T18:05:59.274Z

Reserved: 2026-10-12T14:13:39.027Z

Link: CVE-2026-109305

cve-icon Vulnrichment

Updated: 2026-10-13T18:05:55.169Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T17:17:24.773

Modified: 2026-10-15T15:55:45.630

Link: CVE-2026-109305

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T06:15:14Z

Weaknesses
  • CWE-1336

    Improper Neutralization of Special Elements Used in a Template Engine