CVE-2026-72781 in Craftcms
Summary
by MITRE • 08/11/2026
Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within Craft CMS versions ranging from 5.0.0-RC1 through 5.10.6 and 4.0.0-RC1 through 4.18.2, representing a critical remote code execution flaw in the Twig template sandbox mechanism. The core issue stems from how Craft CMS handles security boundaries within its templating engine, specifically with the ElementInterface marking as safe through the AllowedInSandbox attribute, which creates an unintended pathway for privilege escalation. The vulnerability is particularly dangerous because it leverages the sandbox allowlisting mechanism to extend protection across the entire class hierarchy from ElementInterface up to yii\base\Component, effectively bypassing intended security restrictions.
The technical exploitation occurs when an authenticated attacker with control panel access crafts a malicious Twig template that takes advantage of the yii\base\Component arbitrary function-call gadget. This mechanism allows attackers to invoke methods on objects through the sandboxed environment, even though the sandbox is intended to restrict such operations. The vulnerability operates at the intersection of improper input validation and insufficient privilege separation, where the security boundary designed to contain template execution becomes a gateway for code injection. CWE-742 categorizes this as a "Improper Handling of Special Characters in a Context" issue that enables arbitrary code execution through template manipulation.
The operational impact is severe for organizations relying on Craft CMS, as it transforms a control panel access privilege into full system compromise capability. Attackers can execute arbitrary commands on the server with the privileges of the web application, potentially leading to data theft, service disruption, or further network infiltration. The vulnerability affects both major versions simultaneously, indicating a fundamental flaw in how the framework handles template security boundaries rather than isolated bugs. This issue particularly impacts content management workflows where administrators may unknowingly process malicious templates through the control panel interface.
Mitigation strategies should focus on immediate version upgrades to patched releases, which address the core sandbox mechanism flaws and restrict class hierarchy access. Organizations must also implement additional controls such as monitoring for unauthorized template modifications in the control panel, restricting administrative privileges to minimal necessary personnel, and implementing network segmentation to limit potential lateral movement. The ATT&CK framework categorizes this vulnerability under T1059.008 for "Command and Scripting Interpreter: Python" and T1566.002 for "Phishing: Spearphishing Attachment", as exploitation typically requires initial administrative access through social engineering or credential compromise. Security teams should also consider implementing web application firewalls with template validation rules to detect and block suspicious template content patterns that might indicate attempted exploitation of this vulnerability.