GHSA-H784-HPJP-2RRM Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f5wm-88jv-g5hx. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution...

EUVD-2026-56105

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...

CVE-2026-72781 Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...

CVE-2026-72781

CVE-2026-72781 affects Craft CMS versions 5.0.0-RC1–before 5.10.7 and 4.x RC1–before 4.18.3, where an authenticated control-panel user can trigger a remote code execution via the Twig sandbox escape. The vulnerability arises because Craft marks ElementInterface as safe (AllowedInSandbox) and the ...