Authenticated RCE in Craft CMS via Twig Sandbox Escape

Executive Summary

Craft CMS versions 5.0.0 to 5.10.0 have a remote code execution flaw. Authenticated Control Panel users can bypass the Twig sandbox by injecting uncleansed criteria into getNext, getPrev, or getOwners methods. Attackers can insert malicious Yii config keys like 'as' or 'on' to attach harmful event handlers that execute when element queries run, allowing code execution as the web server user.

Useful 0 Not Useful 0

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 5.0.0 and 5.10.x, the system is vulnerable. Review Twig templates for getNext(), getPrev(), or getOwners() calls with user-controlled criteria. Inspect system logs for unusual element query executions or event handler triggers.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Control Panel access can execute arbitrary code on the server. This could lead to full system compromise, data theft, or unauthorized modifications. Even lower-privilege editors might exploit it via system messages or element-select conditions.

Useful 0 Not Useful 0

Compliance Impact

This RCE vulnerability could result in unauthorized data access, modification, or exfiltration, violating GDPR and HIPAA requirements for data protection and integrity. Organizations may face compliance penalties if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Craft CMS to version 5.11.0 or later immediately. Disable the Twig sandbox if enabled. Review and restrict Control Panel user permissions, especially for lower-privilege editors. Audit system messages and element-select condition rules for suspicious criteria patterns.

Useful 0 Not Useful 0