Craft CMS prior to 5.9.0-beta.1 and 4.17.0-beta.1 implements a blocklist that is intended to prevent the execution of dangerous PHP functions through Twig non‑Closure arrow functions. The blocklist, however, does not include all potentially harmful PHP functions. Attackers who acquire either administrative privileges, the ability to modify system settings via allowAdminChanges, or access to the System Messages utility can exploit this omission to invoke disallowed PHP functions, allowing them to execute arbitrary code, read files, or perform SSRFs and SSTIs. This vulnerability is essentially a code‑execution flaw and is classified under CWE‑1336, CWE‑184, and CWE‑94.

The back‑end product affected is Craft CMS. The CVE applies to all versions released before 5.9.0-beta.1 and 4.17.0-beta.1, including legacy 5.0.0 releases and the 4.0.0 series up through rc3. Any installation of those users is considered vulnerable unless the back‑end has been upgraded to the fixed versions. The vulnerability is tied to the system configuration that permits admin changes or provides access to system‑message editing functions. Administrators using the affected CMS should check the version in use against the fixed releases.

The flaw carries a CVSS score of 9.4, indicating a high‑severity risk. Its EPSS score is below 1 %, implying a low probability that an exploit is actively used; however the vulnerability is not listed in the CISA KEV catalog. Because the attack requires privileged access, the exploitation pathway is limited to environments where an attacker can enable allowAdminChanges or compromise an admin account. The overall risk is elevated for production sites that have not upgraded and still expose the required interfaces. The highest threat is the potential for remote code execution if the blocklist is bypassed.