Loading story…
Craft CMS disclosed six vulnerabilities affecting 4.x and 5.x releases, including a critical remote code execution flaw tracked as CVE-2026-72781. The most severe issue affects versions 5.0.0-RC1 through before 5.10.7 and 4.0.0-RC1 through before 4.18.3, where an authenticated user with control panel access can render a malicious Twig template and execute arbitrary code even when the Twig sandbox is enabled. The flaw stems from Craft marking ElementInterface as safe and extending sandbox allowlisting through the class hierarchy to yii\base\Component, creating an arbitrary function-call gadget.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE, CVE-2026-72781, was received by disclosure@vulncheck.com for a remote code execution flaw in Craft CMS involving a Twig sandbox escape. The issue affects Craft CMS 5.0.0-RC1 through before 5.10.7 and 4.0.0-RC1 through before 4.18.3.
Six Craft CMS vulnerabilities were publicly reported, including one critical and five high-severity issues spanning remote code execution, tampering, privilege escalation, information disclosure, authentication bypass, and arbitrary file read. The disclosure noted affected 4.x and 5.x versions and advised users to update according to the vendor’s security bulletins.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Craft CMS disclosed and patched two **critical** vulnerabilities, `CVE-2025-32432` and `CVE-2024-58136`, that can be chained or abused to achieve **unauthenticated remote code execution** and full compromise of vulnerable servers. The flaws affect Craft CMS `5.x` before `5.6.17`, `4.x` before `4.14.15`, and `3.x` before `3.9.15`; one issue involves insufficient input validation in image transformation functionality, while the other stems from unsafe handling of the `__class` variable in the underlying Yii 2 framework. Researchers and national defenders reported that the vulnerabilities are being **actively exploited in the wild**, with investigations tying attacks to malicious requests targeting the `actions/assets/generate-transform` endpoint and abuse of `__class` parameters. Organizations running exposed Craft CMS instances were urged to patch immediately, review logs for suspicious POST activity, check file and system integrity, and rotate credentials if compromise is suspected.
Aug 15, 2026
**CVE-2024-56145** enables unauthenticated remote code execution in Craft CMS when PHP's `register_argc_argv` setting is enabled. Craft CMS bootstrap code accepted CLI-style options from the web-populated `$_SERVER['argv']` array, allowing query-string input to override application paths, including the templates directory. The affected condition was present in Craft CMS's official Docker configuration. An attacker can redirect template resolution to an attacker-controlled FTP server and leverage PHP's FTP stream wrapper to satisfy file-existence checks before Craft CMS downloads and renders a malicious Twig template. Although Twig blocked several direct dangerous callbacks, the published technique bypassed those restrictions through `call_user_func` used by the `sort` filter. Craft CMS fixed the flaw in versions **5.5.2** and **4.13.2** and later; organizations unable to upgrade should disable `register_argc_argv` and review exposed Craft deployments for suspicious template-path overrides.
Sep 3, 2026
A critical **server-side template injection** flaw tracked as `CVE-2026-54390` affects **JTL Shop** versions **5.2.0 through 5.7.1**, where unsanitized user input is passed to the **Smarty** template engine. The vulnerability allows **unauthenticated remote attackers** to inject malicious template syntax and access sensitive server-side information, including **database credentials** and **encryption keys**. On **JTL Shop 5.4.0 through 5.7.1**, the flaw can be escalated to **remote code execution** by abusing registered Smarty modifiers such as `unserialize` and `file_get_contents` to write a **webshell** into the web root and run arbitrary commands as the web server user. The issue has been rated **critical** with **CVSS 3.1 9.8** and **CVSS 4.0 9.3**, and affected organizations are advised to upgrade to **JTL Shop 5.7.2 or later** and ensure user input reaching the template engine is properly sanitized.
Jun 29, 2026