CVE-2026-79988: CWE-693 Protection Mechanism Failure in craftcms cms

The vulnerability in Craft CMS arises from the Twig sandbox mechanism being configured to permit dangerous functionality from the Yii framework. This configuration flaw leads to authenticated remote code execution (RCE), classified under CWE-693 (Protection Mechanism Failure). The issue affects specific release candidate versions 4.0.0-RC1 and 5.0.0-RC1 of Craft CMS. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

An authenticated attacker can exploit the misconfiguration in the Twig sandbox to execute arbitrary code remotely on the affected Craft CMS installations. This can lead to full compromise of the CMS environment, impacting confidentiality, integrity, and availability of the system. The vulnerability is high severity with a CVSS score of 8.7.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to authenticated users and monitor for suspicious activity related to Twig template usage. Avoid deploying affected release candidate versions in production environments.