The vulnerability resides in Craft CMS’s Twig sandbox, which is configured to allow dangerous functionality from the Yii framework. This misconfiguration permits an attacker with authenticated access to craft arbitrary code execution. The weakness aligns with CWE-693, indicating an insecure implementation that defers the responsibility of ensuring proper restriction of sensitive operations. The resultant impact is the ability to run system‑level commands, exfiltrate data, or undermine the entire CMS installation.

Based on the reference to a release tag 5.10.7, it is inferred that the vulnerability existed in versions prior to that update. The affected product is Craft CMS. Administrators should verify the version of Craft CMS in use and assess whether it predates 5.10.7, as that release appears to provide remediation for this issue.

The CVSS score of 8.7 indicates high severity, and the EPSS is not available, so the exploitation probability cannot be quantified. The vulnerability is not cataloged in the CISA KEV list. Based on the description, it is inferred that the attack vector requires authenticated access to the CMS, implying that privileged or editor‑level users can exploit the flaw. Consequently, the risk is that an attacker who can log in to the CMS may exploit the sandbox to execute arbitrary code.