CVE-2026-109305
Received Received - Intake

Twig Sandbox Bypass in Craft CMS

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109305
EUVD
EUVD-2026-97607

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms cms 5.10.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109305 is a high-severity Twig sandbox bypass in Craft CMS versions 5.10.2 to 5.10.13. It allows non-admin users with the System Messages permission to bypass sandbox restrictions using the 'has some' and 'has every' operators to invoke PHP callables like passthru or system, enabling remote code execution as the web user.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 5.10.2 and 5.10.13, the system is vulnerable. Inspect Twig templates for use of 'has some' or 'has every' operators in sandboxed contexts.

Impact Analysis

Attackers could exploit this to execute arbitrary commands on your server as the web user. This could lead to data theft, system compromise, or further network infiltration. The impact depends on the permissions of the web user account.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.14 or later immediately. Disable the System Messages permission for non-admin users until patched. Review and restrict access to sandboxed Twig template features.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109305. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart