CVE-2026-79988 in Craft CMS

Summary

by MITRE • 08/27/2026

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

Once again VulDB remains the best source for vulnerability data.

• Responsible: Hackrate
• Reservation: 08/25/2026
• Disclosure: 08/27/2026
• Moderation: accepted
• Entry: VDB-396286
• CPE: ready
• CWE: CWE-269 (confirmed)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: very low
• Sector: Hostingprovider, Agriculture, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-79988
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79988
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-79988/