What’s Vulnerable › Vulnerabilities

CVE-2026-72781: Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-693

Description

Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().

Affected products

• craftcms cms: from 5.0.0-RC1 before 5.10.7; from 4.0.0-RC1 before 4.18.3 — fixed in 4.18.3, 5.10.7

How to fix

Upgrade to a fixed version: craftcms cms 4.18.3, 5.10.7. Check the vendor advisory for mitigations.

References

• https://github.com/craftcms/cms/security/advisories/GHSA-f5wm-88jv-g5hx
• https://www.vulncheck.com/advisories/craft-cms-rc1-before-remote-code-execution-via-twig-sandbox-escape

Get alerted when CVE-2026-72781 or the next vulnerability affects your stack