{"id":"CVE-2026-109305","published":"2026-10-12T17:17:24.773","lastModified":"2026-10-15T15:55:45.630","description":"Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the \"has some\" and \"has every\" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1336"],"vendors":[],"products":[],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-vfcw-xv8p-8rj2","tags":[]},{"url":"https://www.vulncheck.com/advisories/craft-cms-5.10.2-before-5.10.14-twig-sandbox-bypass-rce-via-has-some-has-every","tags":[]}],"exploitRefs":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-vfcw-xv8p-8rj2","tags":[]}],"hasPoc":true,"ai":{"summary":"A Twig sandbox bypass in Craft CMS allows non-admin users with System Messages permission to execute arbitrary PHP code by invoking callables like passthru or system through 'has some' and 'has every' operators. This creates a high-severity remote code execution vulnerability.","exploitability":"Exploitation is relatively straightforward for users with System Messages permission, requiring only template rendering with crafted input to trigger PHP function calls.","blast_radius":"The vulnerability could affect any Craft CMS installation running versions 5.10.2 through 5.10.13, potentially allowing attackers to execute arbitrary code as the web server user across multiple sites.","remediation":"Upgrade to Craft CMS 5.10.14 immediately to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","twig","cms","sandbox-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:53:30.587Z"}}