CVE-2026-115938 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

PT-2026-94110

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.10.0 through 5.10.12 Description An authenticated low-privilege control panel user with edit rights on a single element type can achieve server-side template injection, leading to arbitrary PHP code execution and full serv...