Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS versions >=4.0.0-RC1 before 4.18.3 and >=5.0.0-RC1 before 5.10.7 have a remote code execution vulnerability in the Twig sandbox mechanism. The vulnerability arises because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute, and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component). This allows an authenticated attacker with control panel permissions to render a malicious Twig template that exploits the yii\base\Component arbitrary function-call gadget to execute arbitrary code, bypassing the Twig sandbox protections.

An authenticated attacker with permission to access the Craft CMS control panel can execute arbitrary code on the server by exploiting this vulnerability. This can lead to full system compromise, data theft, or service disruption. The vulnerability affects confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, restrict control panel access to trusted users only and monitor for suspicious activity related to Twig template rendering.