CyberRota Analysis
AI-GeneratedCraft CMS versions 5.0.0-RC1 through 5.10.7 and 4.0.0-RC1 through 4.18.3 are vulnerable to a remote code execution flaw due to improper handling of the Twig sandbox mechanism, allowing authenticated attackers with control panel access to execute arbitrary code. The vulnerability arises from the ElementInterface being marked as safe, which permits exploitation through crafted Twig templates. Organizations using affected versions of Craft CMS should prioritize patching this vulnerability to mitigate the risk of unauthorized code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().