The Twig sandbox in Craft CMS implements a SecurityPolicy that allowlists classes, methods, and properties for use in user-defined templates. However, the allowlisting mechanism is overly permissive, allowing all methods and properties of an allowed class and its subclasses. Craft CMS marks the ElementInterface as safe, and since Element extends craft\base\Component, which in turn extends yii\base\Component, the sandbox inadvertently permits access to a dangerous function call gadget in yii\base\Component. This gadget has been previously exploited in multiple Craft CMS RCE vulnerabilities. Consequently, an authenticated attacker with control panel access can render a malicious Twig template to achieve remote code execution, even when the Twig sandbox is enabled.

An authenticated attacker with permission to access the Craft CMS control panel can exploit this vulnerability to execute arbitrary code on the server. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability bypasses the intended restrictions of the Twig sandbox, enabling remote code execution despite sandbox protections.

A patch is available for this vulnerability. It is recommended to apply the official fix provided by Craft CMS to remediate the issue. Until patched, restrict control panel access to trusted users only. Review and update Twig sandbox allowlists to avoid permitting dangerous classes or methods. Monitor vendor advisories for updated remediation guidance.