Craft CMS versions >=5.0.0-RC1 before 5.10.7 and >=4.0.0-RC1 before 4.18.3 have a remote code execution vulnerability in the Twig sandbox. The vulnerability stems from the ElementInterface being marked as safe via the AllowedInSandbox attribute, which extends allowlisting to the entire class hierarchy from craft\base\Component up to yii\base\Component. An authenticated attacker with control panel permissions can exploit this by rendering a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, bypassing the protections of the Twig sandbox enabled by enableTwigSandbox().

An authenticated attacker with permission to access the control panel can execute arbitrary code remotely on affected Craft CMS installations. This could lead to full system compromise depending on the privileges of the application user. The vulnerability bypasses the Twig sandbox protections, increasing the risk of exploitation in environments relying on this sandboxing mechanism.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict control panel access to trusted users only and consider disabling or limiting the use of Twig sandbox features if feasible. Monitor vendor channels for updates and apply patches promptly once released.