DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-F5WM-88JV-G5HX: GHSA-F5WM-88JV-G5HX: Authenticated Remote Code Execution via Twig Sandbox Escape in Craft CMS

#security #cve #cybersecurity #ghsa

GHSA-F5WM-88JV-G5HX: Authenticated Remote Code Execution via Twig Sandbox Escape in Craft CMS

Vulnerability ID: GHSA-F5WM-88JV-G5HX
CVSS Score: 8.7
Published: 2026-08-06

An authenticated remote code execution vulnerability exists in Craft CMS due to a flaw in how the Twig template sandbox policy handles class-level allowlists. Prior to the fix, the security policy allowed arbitrary public methods from parent classes of allowed interfaces, allowing authenticated attackers to invoke Yii component methods such as attachBehavior on element models to load arbitrary classes and execute system commands.

TL;DR

Authenticated control panel users can escape the Twig template sandbox in Craft CMS by calling the inherited 'attachBehavior' method on allowed Element objects, leading to arbitrary PHP class instantiation and remote command execution on the server.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-693
  • Attack Vector: Network
  • CVSS v4.0: 8.7 (High)
  • Privileges Required: Low
  • Exploit Status: Proof of Concept (PoC)
  • CISA KEV Listed: No

Affected Systems

  • Craft CMS installations running 4.x prior to 4.18.3
  • Craft CMS installations running 5.x prior to 5.10.7
  • Craft CMS: >= 4.0.0-RC1, < 4.18.3 (Fixed in: 4.18.3)
  • Craft CMS: >= 5.0.0-RC1, < 5.10.7 (Fixed in: 5.10.7)

Code Analysis

Commit: 0b8be15

Strictly validate sandboxed method execution through AllowableInSandbox interface

Mitigation Strategies

  • Upgrade Craft CMS immediately to patched versions.
  • Disable or restrict access to Twig template editing interfaces.
  • Apply Web Application Firewall (WAF) filters to block behavior injection signatures.

Remediation Steps:

  1. Identify the current Craft CMS version using 'composer show craftcms/cms'.
  2. Run 'composer update craftcms/cms' to pull the latest security release.
  3. Verify that the installed version is updated to at least 4.18.3 or 5.10.7.
  4. Audit existing user roles and restrict template design capabilities to trusted administrators only.

References

Read the full report for GHSA-F5WM-88JV-G5HX on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)