Server-Side Template Injection

Craft CMS is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of Twig input using the map filter in certain fields, which allows an attacker to craft malicious payloads and execute arbitrary code on the server...

Remote Code Execution (RCE)

craftcms/cms is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of template inputs in Twig, which allows an attacker to inject malicious templates and execute arbitrary code on the server...