CVE-2026-109305 in Craft CMS
Summary
by MITRE • 10/12/2026
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
Craft CMS versions prior to 5.10.14 contain a critical security vulnerability related to the Twig templating engine's sandboxing mechanism, specifically designated as CVE-2023-46738. This flaw allows authenticated users with limited privileges, such as those possessing only the System Messages permission, to bypass the intended execution restrictions imposed by the Twig sandbox. The core of the issue lies in how certain comparison operators within the template language interact with PHP callables. Specifically, the has some and has every operators were found to be insufficiently restricted when evaluating arrays or objects containing callable functions. This oversight enables an attacker to construct a malicious payload that invokes arbitrary PHP functions directly from within a sandboxed context where such actions should strictly be prohibited by design.
The technical mechanism of this vulnerability exploits the way Twig handles function calls during template rendering. When a user supplies input for these specific operators, the engine fails to properly validate whether the callable being invoked is whitelisted or safe for execution in a restricted environment. By providing two-argument callables such as passthru or system, an attacker can trick the interpreter into executing shell commands on the underlying server operating system. This effectively breaks out of the sandbox isolation that protects the application from arbitrary code execution attacks originating from user-controlled template data. The vulnerability is particularly dangerous because it does not require administrative access; any authenticated user with minimal permissions can leverage this flaw to gain a foothold within the web server's process context.
The operational impact of this vulnerability is severe, as it leads directly to Remote Code Execution (RCE). An attacker who successfully exploits this issue can execute arbitrary commands on the host machine running the Craft CMS instance. This capability allows for complete compromise of the application and potentially the underlying infrastructure. Consequences include unauthorized access to sensitive data stored in the database, modification or deletion of content, installation of web shells for persistent access, and use of the compromised server as a pivot point for further attacks against internal networks. The ability to execute system-level commands means that attackers can manipulate files, run network tools, and potentially escalate privileges depending on the configuration and security posture of the hosting environment.
This vulnerability is classified under Common Weakness Enumeration (CWE) categories such as CWE-94 Improper Control of Generation of Code or CWE-78 OS Command Injection, reflecting its nature as a failure to properly sanitize inputs that result in command execution. In terms of the MITRE ATT&CK framework, this exploit aligns with techniques involving Execution via Template Engines and potentially Command and Scripting Interpreter components like Unix Shell if Linux-based hosting is used. The attack vector typically involves crafting specific HTTP requests or manipulating template variables during normal user interactions, making it difficult to detect through standard web application firewalls that do not specifically inspect Twig syntax for sandbox bypass patterns.
Mitigation strategies focus primarily on immediate software updates and defensive coding practices. Organizations running Craft CMS must upgrade to version 5.10.14 or later, where the developers have patched the logic governing these operators to enforce stricter validation of callable types within the sandboxed environment. Until an update can be applied, administrators should consider restricting access to templates that utilize dynamic function calls and ensuring that web server processes run with minimal privileges to limit the blast radius of a potential compromise. Additionally, implementing strict Content Security Policies and monitoring for unusual outbound network connections or file system modifications can help detect exploitation attempts in real-time. Regular security audits and penetration testing are recommended to identify similar weaknesses in custom template code or third-party plugins that may interact with the templating engine.