CVE-2026-123490

Craft CMS versions 5.8.17 through 5.11.2 are vulnerable to a privilege escalation vulnerability. The issue resides in the getOwners() function, which fails to cleanse query configurations when applying caller criteria. This allows authenticated control panel users to execute arbitrary static PHP ...

CVE-2026-123490 Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account ...

EUVD-2026-118290

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account ...

CVE-2026-123490: craftcms cms: Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller…

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account ...

CVE-2026-112773

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773

Craft CMS versions 5.0.0 before 5.11.0 are vulnerable to a remote code execution (RCE) vulnerability. The flaw allows authenticated Control Panel users to escape the Twig sandbox by providing uncleansed criteria to the getNext, getPrev, or getOwners functions. By injecting Yii "as" or "on" config...

EUVD-2026-104579

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773: Improper Control of Generation of Code

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

PT-2026-117624

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

Craft CMS code injection vulnerability

A code injection vulnerability exists in Craft CMS versions 5.0.0 through 5.11.0. This vulnerability stems from a Twig sandbox escape, Authenticated control panel users can pass unsanitized conditions to getNext, getPrev, or getOwners and inject malicious event handlers attached to Yii’s “as” or...