The flaw is a server‑side template injection that lets an authenticated administrator inject code into Twig template fields such as email templates. By calling the craft.app.fs.write() function, the attacker can write a malicious PHP script to a public directory and later execute it, giving arbitrary system‑command execution on the host. The weakness is identified as CWE‑1336 and the impact is the complete compromise of confidentiality, integrity, and availability of the affected website.

CraftCMS Craft CMS content management system. All 4.x releases prior to 4.17.0‑beta.1 and all 5.x releases prior to 5.9.0‑beta.1 expose the vulnerability. If a site is running any version of Craft CMS that has not yet applied the update, it is affected.

This critical condition scores 9.4 on CVSS; the EPSS probability is lower than 1%, and the vulnerability is not yet listed in the CISA KEV catalog. The only prerequisite for exploitation is an authenticated administrator account, after which an attacker can inject an SSTI payload into any writable Twig field. The craft.app.fs.write() call then creates a PHP script in a publicly accessible directory, which can be invoked via the browser to run arbitrary commands. Delaying patching could leave a site open to complete takeover by exploiting this flaw.