EUVD-2026-97607

Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates t...

CVE-2026-109305

Craft CMS versions 5.10.2 through 5.10.13 contain a Twig sandbox bypass vulnerability. This flaw allows non-admin users with the System Messages permission to invoke arbitrary PHP callables (such as passthru or system) via the "has some" and "has every" operators in sandboxed templates. Successfu...