In Craft CMS versions 5.9.0 through 5.9.x, control panel users with the ability to edit entries can exploit improper neutralization of special elements in the Twig template engine by supplying a crafted HTTP Referer header. The signed redirect URL string is compiled using renderObjectTemplate() without sandboxing, despite the existence of a sandboxed alternative renderSandboxedObjectTemplate(). This flaw allows execution of arbitrary Twig code during entry save operations, potentially leading to authenticated remote code execution. The vulnerability is addressed in version 5.10.0.

An attacker with control panel entry editing permissions can execute arbitrary Twig code via the HTTP Referer header, potentially resulting in authenticated remote code execution. This elevates the risk of full system compromise under the affected versions prior to 5.10.0.

Upgrade Craft CMS to version 5.10.0 or later, where this vulnerability is fixed by using sandboxed template rendering for the signed redirect URL. Patch status is not explicitly stated beyond the fix in 5.10.0, so users should apply this official update promptly.