Craft CMS is vulnerable to authenticated server‑side template injection (SSTI) when the Twig map filter is used in certain text fields within the control panel or the System Messages utility. The weakness can be exploited to execute arbitrary code on the web server, a type of vulnerability categorized as CWE‑1336. The attack requires an attacker to have credentials with administrator privileges or, alternatively, a non‑administrator account that still has access to the System Messages utility while allowAdminChanges is disabled. A successful exploit would compromise the confidentiality, integrity, and availability of the CMS instance and any associated data.

The vulnerability affects Craft CMS versions prior to 5.8.22 and 4.16.18. The affected product is Craft CMS, maintained by Craftcms:cms, and includes all releases listed such as 4.0.0 (rc1, rc2, rc3) and 5.0.0 (rc1).

The CVSS score is 8.6, indicating high severity, while the EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is achievable only by authenticated users with the necessary access levels, implying that limiting non‑admin interaction or disabling allowAdminChanges decreases the exploitability. The combination of a high severity rating and limited attack surface results in a moderate overall risk for systems that remain at the affected versions or are deployed in production environments without proper configuration.