Live › vulnerability › CVE-2026-112773
Go to dashboardCraft CMS 5.0.0 to before 5.11.0: an authenticated Control Panel user can escape the Twig sandbox through uncleansed criteria passed to getNext, getPrev or getOwners. Yii 'as'/'on' keys attach a malicious event handler to the element query, which runs code as the web user. It only applies when enableTwigSandbox is true; that setting defaults to false. Low-privilege CP editors can reach it through element-select condition rules.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product |
|---|
| Ecosystem |
|---|
| Affected |
|---|
| Fixed in |
|---|
| craftcms/cms | composer | >= 5.0.0, < 5.11.0 | 5.11.0 |
composer show craftcms/cms and see whether the version is 5.0.0 to 5.10.x5.11.0 or later (composer update craftcms/cms)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.
This page as .md · .json · in your agent: get_signal("CVE-2026-112773")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.