CVE-2026-105985: Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.
Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().
This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.
The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with basic Craft Control Panel access can exploit it. It was reproduced using an active non-admin Craft Team user with no optional permissions enabled.
Does exploitation require access to content editing, administrative settings, or server-side secrets?
No. The reproduced attack did not require entry-editing, Settings, utilities, user management, project configuration, filesystem access, Kubernetes access, or environment variables.
What level of access can an attacker gain?
The vulnerable rendering path can evaluate attacker-supplied Twig without sandboxing, allowing calls to PHP functions such as system(). This can result in operating-system command execution with the privileges of the PHP or web-server process.
What interaction is required from the attacker?
The attacker must be able to authenticate to the Control Panel and submit requests to the app/render-components action. No additional victim interaction is described.