CVE-2026-112773

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.x

Description Authenticated Control Panel users can achieve remote code execution by escaping the Twig sandbox. This occurs when uncleansed criteria are passed to the getNext(), getPrev(), or getOwners() functions. An attacker can inject Yii as or on configuration keys to attach malicious event handlers that execute as the web user when the element query runs.

Recommendations Update Craft CMS to version 5.11.0 or later.