CVE-2026-109305: Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every

Q: Which users can exploit this issue?

A non-admin user needs the System Messages permission. That permission allows them to provide sandboxed template content that can invoke PHP callables through the affected Twig operators.

Q: What access and interaction are required for exploitation?

The vulnerability is network-accessible, has low attack complexity, requires low privileges, and does not require user interaction. An attacker must be able to supply a two-argument callable, such as passthru or system, in a sandboxed template.

Q: What is the impact if exploitation succeeds?

Successful exploitation allows code execution as the web user. The reported impact includes high confidentiality, integrity, and availability impact.

Q: Which versions are affected?

Craft CMS versions from 5.10.2 before 5.10.14 are affected. Updating to 5.10.14 or later removes the affected version range.

Published Oct 12, 2026

Updated

Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.

Affected Software

1 affected component

Craft CMS Craft CMS>=5.10.2<5.10.14

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

A non-admin user needs the System Messages permission. That permission allows them to provide sandboxed template content that can invoke PHP callables through the affected Twig operators.

What access and interaction are required for exploitation?

The vulnerability is network-accessible, has low attack complexity, requires low privileges, and does not require user interaction. An attacker must be able to supply a two-argument callable, such as passthru or system, in a sandboxed template.

What is the impact if exploitation succeeds?

Successful exploitation allows code execution as the web user. The reported impact includes high confidentiality, integrity, and availability impact.

Which versions are affected?

Craft CMS versions from 5.10.2 before 5.10.14 are affected. Updating to 5.10.14 or later removes the affected version range.

CVE-2026-109305: Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What access and interaction are required for exploitation?

What is the impact if exploitation succeeds?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What access and interaction are required for exploitation?

What is the impact if exploitation succeeds?

Which versions are affected?