Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-79988

Authenticated RCE through Twig sandbox escape

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Hackrate

Description

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

craftcms cms

Default version status: unaffected

  • 4.0.0-RC1 to < 4.18.3affected
  • 5.0.0-RC1 to < 5.10.7affected

References