Craft CMS versions 5.0.0 through 5.10.x contain a flaw that lets authenticated Control Panel users escape the Twig sandbox by passing unfiltered criteria to element query methods such as getNext, getPrev, or getOwners. By injecting specialized Yii configuration keys – namely "as" or "on" – an attacker can attach custom event handlers that execute when the query runs, giving the ability to run arbitrary PHP code as the web application user. This is a classic code‑injection vulnerability classified under CWE‑94.

The issue affects installations running Craft CMS beginning with version 5.0.0 up to but excluding 5.11.0. The vulnerability is tied to the craftcms:cms package and is relevant only when the application’s admin interface is accessible to authenticated users. Versions 5.11.0 and later include the vendor supplied patch that removes the sandbox escape path.

The flaw carries a CVSS score of 8.7, indicating high severity. Although EPSS data is not available, the vulnerability is currently not listed in CISA KEV. The attack vector is remote but relies on authenticated access to the Control Panel; successful exploitation would allow execution of code with the web process’s privileges, potentially enabling full system compromise if that user has elevated rights. Due to the high impact and the requirement for authentication, applying the vendor patch promptly is essential.