Craft CMS allows an authenticated administrator to exploit a server‑side template injection via the Twig create() function, which internally calls Craft::createObject(). By chaining this with a bundled Symfony Process gadget, an attacker can instantiate arbitrary PHP classes, leading to remote code execution on the system hosting the CMS. The flaw bypasses a prior fix for a related vulnerability, and is classified as CWE‑1336, indicating a compromised templating engine.

Versions of Craft CMS prior to the release of 5.9.0‑beta.1 and 4.17.0‑beta.1 are vulnerable; specifically administratively privileged users on Craft CMS 5.8.21 and earlier 5.x releases can exercise this weakness while earlier 4.x releases below 4.17.0‑beta.1 are also impacted.

The CVSS score of 7.5 marks high severity, but the EPSS score of less than 1 % suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, implying no widely documented exploitation yet. Bypassing of an earlier fix heightens the risk if administrators rely on that patch. Attack requires authenticated admin credentials; once achieved, the attacker can execute arbitrary system commands with the PHP process sandbox. Vigilance and timely patching are therefore critical.