CVE-2026-72781: Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.7 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.18.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72781?
The severity of CVE-2026-72781 is high, with a CVSS score of 8.8.
How do I fix CVE-2026-72781?
To fix CVE-2026-72781, update Craft CMS to version 5.10.7 or later, or to version 4.18.3 or later.
What type of vulnerability is CVE-2026-72781?
CVE-2026-72781 is a remote code execution vulnerability affecting the Twig sandbox mechanism in Craft CMS.
What versions of Craft CMS are affected by CVE-2026-72781?
CVE-2026-72781 affects Craft CMS versions 5.0.0-RC1 through 5.10.6 and 4.0.0-RC1 through 4.18.2.
What impact does CVE-2026-72781 have on security?
CVE-2026-72781 allows an attacker to execute arbitrary code on the server via the Twig sandbox escape, potentially compromising the entire system.