EUVD-2026-109206

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938

In Craft CMS , an authenticated control panel user can exploit a vulnerability where the allowed column filter delegates property lookups to Yii ArrayHelper , bypassing the Twig sandbox 's security policies. By submitting an element-search condition, an attacker can use repeated single-segment lo...

CVE-2026-115938 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

PT-2026-122243

Name of the Vulnerable Software and Affected Versions Craft CMS affected versions not specified Description Authenticated control panel users can submit an element-search condition where the element selector is evaluated as a sandboxed Twig object template. The column filter delegates property...

CVE-2026-112771 Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue without consulting the sandbox security policy. Authenticated...

CVE-2026-112771 Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue without consulting the sandbox security policy. Authenticated...

CVE-2026-112771

Craft CMS versions 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 are vulnerable to a Twig sandbox allowlist bypass . The issue arises because specific filters—including column , contains , filterByValue , index , where , and multisort —resolve caller-supplied keys using ArrayHelper::getValue() with...

CVE-2026-112771 Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue without consulting the sandbox security policy. Authenticated...

PT-2026-117622

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.7 Craft CMS versions 5.0.0 through 5.10.9 Description A Twig sandbox allowlist bypass exists because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys vi...

CVE-2026-112771: Exposure of Sensitive Information to an Unauthorized Actor

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue without consulting the sandbox security policy. Authenticated...

Craft CMS Information Disclosure Vulnerability

Craft CMS contains an information disclosure vulnerability stemming from a bypass of the Twig sandbox allowlist. the column, contains, filterByValue, index, where, and multisort filters do not adhere to the sandbox security policy when parsing keys provided by the caller via ArrayHelper::getValue...