CVE-2026-72781
Received Received - Intake

Remote Code Execution in Craft CMS via Twig Sandbox Bypass

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72781
EUVD
EUVD-2026-56105

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
craftcms craft_cms From 5.0.0-RC1 (inc) to 5.10.7 (exc)
craftcms craft_cms From 4.0.0-RC1 (inc) to 4.18.3 (exc)
craftcms craft_cms From 4.0.0-RC1 (inc) to 4.18.2 (inc)
craftcms craft_cms From 5.0.0-RC1 (inc) to 5.10.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72781 is a remote code execution (RCE) vulnerability in Craft CMS versions 4.0.0-RC1 to 4.18.2 and 5.0.0-RC1 to 5.10.6. It occurs because the Twig sandbox mechanism incorrectly allows dangerous Yii framework functionality. Authenticated attackers with control panel access can exploit this by rendering malicious Twig templates to execute arbitrary code, even when the sandbox is enabled.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 4.0.0-RC1-4.18.2 or 5.0.0-RC1-5.10.6, the system is vulnerable. Review Twig template usage in control panel for suspicious activity.

Impact Analysis

An attacker could gain full control over your Craft CMS instance, steal sensitive data, modify content, or install malware. This requires only authenticated access to the control panel, making it dangerous for any Craft CMS deployment.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using affected Craft CMS versions may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Craft CMS to version 4.18.3 or 5.10.7 or later immediately. Disable Twig sandbox if not required. Restrict control panel access to trusted users only. Monitor for unauthorized code execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72781. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart