Craft CMS versions prior to 4.18.8 and 5.11.0 contain a flaw in the Twig group filter that fails to enforce the required checkArrow guard. When an authenticated control panel user supplies an array‑callable such as FileHelper::writeToFile through element‑select condition rules, the system invokes the callable and writes data to the webroot. This allows the attacker to drop a webshell and execute arbitrary code as the web server process, resulting in a full compromise of the application, data, and surrounding infrastructure.

The affected parties include users running Craft CMS 4.x lower than 4.18.8 or 5.x lower than 5.11.0. Administrators of these installations are directly exposed, while any organization hosting such sites is at risk.

The CVSS score of 8.7 classifies this issue as high severity, indicating that successful exploitation would have severe consequences. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that publicly known exploits are not yet confirmed. Extraction of an array‑callable only requires authenticated access to the control panel, so the likelihood of attack depends on the accessibility and protection of administrative credentials; exposed or weakly secured control panels elevate the threat level.