CVE-2026-105985 in Craft CMS
Summary
by MITRE • 10/06/2026
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.
Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().
This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.
The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
Craft CMS version 5.10.13.2 is affected by a critical authenticated remote code execution vulnerability located within the Control Panel action app/render-components. This flaw allows any authenticated user possessing basic Control Panel access to execute arbitrary PHP code on the server, effectively granting them full control over the underlying operating system with the privileges of the web-server process. The vulnerability stems from an insecure deserialization and template rendering mechanism that fails to properly sanitize or restrict input data before it is processed by Twig templating engine functions.
The technical root cause involves the manipulation of EntryType objects through request-controlled component classes and property overrides. An attacker can exploit this by first overriding the uiLabelFormat property of an EntryType object. Subsequently, when rendering an Entry that resolves to the same request-cached entry type, the system invokes renderObjectTemplate(). This function processes the manipulated properties without adequate validation, allowing arbitrary Twig code supplied in the HTTP request to be evaluated directly. Because this specific render path is not sandboxed, there are no restrictions preventing the execution of dangerous PHP functions within the Twig context.
The operational impact of this vulnerability is severe due to its low barrier for entry and high severity outcome. The attacker does not require administrative privileges or any optional permissions such as access to settings, user management, project configuration, filesystems, Kubernetes clusters, or environment variables. A standard non-admin Craft Team member with no additional rights can trigger the exploit. By leveraging Twig string callables, an adversary can invoke PHP functions like system(), leading directly to operating-system command execution. This capability enables attackers to compromise server integrity, exfiltrate sensitive data, install backdoors, and pivot further into internal networks depending on the deployment environment's network topology and security controls.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and specifically relates to CWE-502 Deserialization of Untrusted Data if the underlying mechanism involves unsafe object instantiation based on user input. In terms of attack vectors, it corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, where attackers use system-level commands to execute actions within an environment. The lack of sandboxing in the render path exacerbates the risk by removing a critical layer of defense that would otherwise isolate template execution from core application logic.
Mitigation strategies should prioritize immediate patching to Craft CMS version 5.10.13.2 or later, where this issue has been addressed through stricter input validation and enhanced sandboxing for Twig rendering operations. Until patches are applied, administrators can implement web application firewall rules to detect and block requests containing suspicious patterns associated with Twig injection or unusual property overrides in the app/render-components endpoint. Additionally, enforcing strict role-based access control policies that limit Control Panel access only to trusted users reduces the attack surface. Monitoring server logs for anomalous activity related to template rendering and entry type resolution can also aid in early detection of exploitation attempts.