CVE-2026-72781

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.6 Craft CMS versions 4.0.0-RC1 through 4.18.2

Description A remote code execution issue exists in the Twig sandbox mechanism. The software marks the ElementInterface as safe using the AllowedInSandbox attribute. Since the sandbox allowlisting extends to the entire class hierarchy from craftbaseComponent up to yiibaseComponent, an authenticated attacker with control panel access can render a malicious Twig template. This allows the attacker to abuse the yiibaseComponent arbitrary function-call gadget to execute arbitrary code, bypassing the protection provided by the enableTwigSandbox() function.

Recommendations Update Craft CMS versions 5.0.0-RC1 through 5.10.6 to version 5.10.7. Update Craft CMS versions 4.0.0-RC1 through 4.18.2 to version 4.18.3.