CVE-2026-105985: Authenticated RCE via render-components Entry Type overrides

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-07
Weakness: CWE-1336

Description

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate(). This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process. The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.

Affected products

craftcms cms: from 5.0.0 before 5.11.0 — fixed in 5.11.0

How to fix

Upgrade to a fixed version: craftcms cms 5.11.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-105985 or the next vulnerability affects your stack