{"id":"CVE-2026-105985","published":"2026-10-06T11:17:16.857","lastModified":"2026-10-07T04:17:46.197","description":"Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.\n\n\n\nAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().\n\n\n\nThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.\n\n\n\nThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1336"],"vendors":[],"products":[],"references":[{"url":"https://github.com/craftcms/cms","tags":[]},{"url":"https://github.com/craftcms/cms/releases/tag/5.11.0","tags":[]},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv","tags":[]},{"url":"https://www.hckrt.com/hacktivity/HCKRT-PVWH7W","tags":[]}],"exploitRefs":[{"url":"https://github.com/craftcms/cms","tags":[]},{"url":"https://github.com/craftcms/cms/releases/tag/5.11.0","tags":[]},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated users to execute arbitrary code via the Control Panel, posing a significant security risk.","exploitability":"Exploitation is relatively straightforward for any authenticated user with basic Control Panel access, requiring no additional permissions.","blast_radius":"If exploited, this vulnerability could lead to complete compromise of the system, including execution of arbitrary commands with PHP/web-server privileges.","remediation":"Upgrade to Craft CMS 5.10.13.3 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:59:05.733Z"}}