CVE-2026-115938

Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Published Oct 23, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.

The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.

After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.

Analysis

Technical impact

Craft CMS allows authenticated control panel users to submit an element‑search condition that is evaluated as a sandboxed Twig template. The framework’s column filter delegates property lookup to Yii’s ArrayHelper, which bypasses Twig’s SecurityPolicy. Repeating single‑segment lookups lets an attacker recover the system’s security key through a stable remote oracle. With that key, they can forge signed parameters that are accepted by an unsandboxed render call, enabling the execution of arbitrary code. The described regression proof uses a safe callback, but the full exploit path can invoke native PHP functions.

Affected Systems

Craft CMS is the affected product. The CVE does not specify exact affected versions, but the vulnerability exists in releases prior to the mitigation published in the 5.11.2 release.

Risk and Exploitability

The vulnerability scores a CVSS of 8.7, indicating high impact. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated control‑panel user and the ability to submit a search condition. Once exploited, an attacker can gain remote code execution on the host. The attack vector is inferred to be network, as the control panel is accessed over HTTP/HTTPS.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

craftcms

cms

unaffected

Version	Status	Constraints
`5.0.0`	affected	< 5.11.2
`4.0.0`	affected	< 4.18.9

No data.

Vendor Product Versions

Craftcms

Cms

Version	Status	Scheme	Platform
`[5.0.0,5.11.2)`	affected	semver	—
`[4.0.0,4.18.9)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Craft CMS to version 5.11.2 or later to receive the fix that restores the sandbox restrictions.
Restrict the element‑search condition interface to administrators or remove it entirely if not needed, thereby limiting the attack surface for authenticated users.
Audit the sandbox configuration and ensure that no user‑supplied templates can invoke native PHP callables, enforcing the allowed methods and properties lists.

Generated by OpenCVE AI on October 23, 2026 at 23:20 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.369% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/craftcms/cms
https://github.com/craftcms/cms/releases/tag/5.11.2
https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6
https://www.hckrt.com/hacktivity/HCKRT-DRNL9W

History

Nov 3, 2026 10:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 23, 2026 10:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists. The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle. After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
Title		Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
First Time appeared		Craftcms Craftcms cms
Weaknesses		CWE-1336
CPEs		cpe:2.3:a:craftcms:cms::::::::
Vendors & Products		Craftcms Craftcms cms
References		https://github.com/craftcms/cms https://github.com/craftcms/cms/releases/tag/5.11.2 https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6 https://www.hckrt.com/hacktivity/HCKRT-DRNL9W
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`