Description
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.



The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.



After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
Published: 2026-10-23
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Craft CMS allows authenticated control panel users to submit an element‑search condition that is evaluated as a sandboxed Twig template. The framework’s column filter delegates property lookup to Yii’s ArrayHelper, which bypasses Twig’s SecurityPolicy. Repeating single‑segment lookups lets an attacker recover the system’s security key through a stable remote oracle. With that key, they can forge signed parameters that are accepted by an unsandboxed render call, enabling the execution of arbitrary code. The described regression proof uses a safe callback, but the full exploit path can invoke native PHP functions.

Affected Systems

Craft CMS is the affected product. The CVE does not specify exact affected versions, but the vulnerability exists in releases prior to the mitigation published in the 5.11.2 release.

Risk and Exploitability

The vulnerability scores a CVSS of 8.7, indicating high impact. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated control‑panel user and the ability to submit a search condition. Once exploited, an attacker can gain remote code execution on the host. The attack vector is inferred to be network, as the control panel is accessed over HTTP/HTTPS.

Generated by OpenCVE AI on October 23, 2026 at 23:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Craft CMS to version 5.11.2 or later to receive the fix that restores the sandbox restrictions.
  • Restrict the element‑search condition interface to administrators or remove it entirely if not needed, thereby limiting the attack surface for authenticated users.
  • Audit the sandbox configuration and ensure that no user‑supplied templates can invoke native PHP callables, enforcing the allowed methods and properties lists.

Generated by OpenCVE AI on October 23, 2026 at 23:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists. The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle. After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
Title Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
First Time appeared Craftcms
Craftcms cms
Weaknesses CWE-1336
CPEs cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*
Vendors & Products Craftcms
Craftcms cms
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Craftcms Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: Hackrate

Published:

Updated: 2026-10-23T21:58:51.816Z

Reserved: 2026-10-23T21:25:32.945Z

Link: CVE-2026-115938

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T22:16:59.597

Modified: 2026-10-23T22:16:59.597

Link: CVE-2026-115938

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T00:45:16Z

Weaknesses
  • CWE-1336

    Improper Neutralization of Special Elements Used in a Template Engine