internet-facing-service-vulnerabilitywidely-deployed-product-advisoryprivilege-escalation-method
Critical Twig Sandbox Escape in Craft CMS Enables Authenticated RCE
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 11, 2026
Craft CMS disclosed six vulnerabilities affecting 4.x and 5.x releases, including a critical remote code execution flaw tracked as CVE-2026-72781. The most severe issue affects versions 5.0.0-RC1 through before 5.10.7 and 4.0.0-RC1 through before 4.18.3, where an authenticated user with control panel access can render a malicious Twig template and execute arbitrary code even when the Twig sandbox is enabled. The flaw stems from Craft marking ElementInterface as safe and extending sandbox allowlisting through the class hierarchy to yii\base\Component, creating an arbitrary function-call gadget.
Do you run this?See affected versions and whether adversaries are exploiting it.
Check your exposure
