Control‑panel users who can edit entries can cause the system to treat the HTTP Referrer header as unsandboxed Twig template code during an entry‑save operation. Because the CMS compiles this string with the regular renderObjectTemplate() method rather than a sandboxed alternative, an attacker can inject arbitrary Twig code that is executed with the permissions of the editing user. This code execution flaw is classified as CWE‑1336 and CWE‑94 and can compromise the underlying web server, providing the attacker with full control over site files, the database, and system resources.

Craft CMS versions 5.9.0 through 5.9.x are vulnerable; the issue was fixed in version 5.10.0. Any installation that employs the control‑panel entry‑editing feature is affected.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% shows a very low exploitation probability, suggesting limited active use. The vulnerability requires an authenticated control‑panel user with entry‑editing rights who must supply a malicious Referer header during the save operation. Once triggered, the attacker achieves authenticated remote code execution. The issue is not currently listed in the CISA KEV catalog.