Craft CMS’s conditions system passes user-controlled input to the Twig renderObjectTemplate() function without sandboxing or escaping, a flaw classified as CWE-94. An attacker can craft a condition rule and send it through standard element listing endpoints to execute arbitrary code on the server, achieving full control over the site once the exploit is triggered.

The vulnerability affects all authenticated Control Panel users—including non‑admin roles such as Author or Editor—on Craft CMS versions prior to 5.9.9 (CMS 5.x) and 4.17.4 (CMS 4.x). The affected product is listed under the provided CPE identifiers for craftcms:craft_cms across the 4.0.0‑to‑5.0.0 series.

The CVSS score of 8.1 indicates high severity. The EPSS score is <1 %, but the requirement of only normal authentication makes it realistic for sites exposing a CP to many users. The vulnerability is not in CISA’s KEV catalog. Exploitation requires valid CP credentials; no additional privilege escalation or network exploitation is needed. The risk is significant for organizations with exposed control panels and fine‑grained user roles. The attack vector is via authenticated CP access rather than remote network exposure.