Description
Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().
Published: 2026-08-11
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Craft CMS’s Twig sandbox permits an authenticated user who can access the control panel to craft a malicious Twig template that exploits the yii\base\Component arbitrary function‑call gadget, allowing execution of arbitrary code on the server. This remote code execution threatens confidentiality, integrity, and availability, potentially leading to full system compromise.

Affected Systems

Craft CMS versions 5.0.0-RC1 through 5.10.6 and 4.0.0-RC1 through 4.18.2 are impacted. The vulnerability is fixed in Craft CMS 5.10.7 and 4.18.3.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and because no EPSS rating is provided the exact exploitation probability remains unknown; nevertheless the risk is high given that the attacker only needs authenticated access to the control panel. The vulnerability is not listed in CISA KEV. If an attacker gains control panel privileges they can immediately execute arbitrary code on the host. The likely attack vector is an authenticated remote manipulator with permission to edit templates via the control panel.

Generated by OpenCVE AI on August 11, 2026 at 23:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch by upgrading to Craft CMS 5.10.7 or later, or to 4.18.3 or later.
  • Review and tighten control‑panel access: limit template‑editing rights to trusted administrators and remove or minimize permissions for lower‑tier accounts.
  • Monitor application logs for suspicious template rendering activity and enforce strict role‑based access controls; consider disabling the Twig sandbox for non‑admin users until the patch is applied.

Generated by OpenCVE AI on August 11, 2026 at 23:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().
Title Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
First Time appeared Craftcms
Craftcms craft Cms
Weaknesses CWE-693
CPEs cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
Vendors & Products Craftcms
Craftcms craft Cms
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Craftcms Craft Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-11T14:01:32.931Z

Reserved: 2026-08-10T15:09:12.955Z

Link: CVE-2026-72781

cve-icon Vulnrichment

Updated: 2026-08-11T14:01:29.233Z

cve-icon NVD

Status : Received

Published: 2026-08-11T13:19:08.657

Modified: 2026-08-11T15:17:36.130

Link: CVE-2026-72781

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T10:45:03Z

Weaknesses
  • CWE-693

    Protection Mechanism Failure