CVE-2026-112773: Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.11.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an authenticated Craft CMS Control Panel account. The issue is remotely reachable and does not require user interaction once the attacker has that level of access.
Which deployments are affected?
Craft CMS versions from 5.0.0 up to, but not including, 5.11.0 are affected. The vulnerability is triggered through Twig sandbox handling of criteria passed to getNext, getPrev, or getOwners.
What level of access can successful exploitation provide?
Successful exploitation can execute code as the web user. This can affect confidentiality, integrity, and availability of the affected system.