{"id":"CVE-2026-112773","kind":"vulnerability","aliases":["CVE-2026-112773"],"related":[],"title":"Craft CMS: Control Panel users can run code via Twig sandbox escape","description":"Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii \"as\" or \"on\" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.","summary":"Craft CMS 5.0.0 to before 5.11.0: an authenticated Control Panel user can escape the Twig sandbox through uncleansed criteria passed to getNext, getPrev or getOwners. Yii 'as'/'on' keys attach a malicious event handler to the element query, which runs code as the web user. It only applies when enableTwigSandbox is true; that setting defaults to false. Low-privilege CP editors can reach it through element-select condition rules.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"craftcms/cms","fixed":["5.11.0"],"affected":">= 5.0.0, < 5.11.0","ecosystem":"composer"}],"ecosystems":[],"tags":["craft-cms","package","php","rce","self-hosted","twig"],"not_affected_if":["default-config","managed-hosting","no-control-panel-users-untrusted","version-5.11.0-or-later","version-below-5.0.0"],"how_to_check":"Run 'composer show craftcms/cms' and see whether the version is 5.0.0 to 5.10.x. Then check config/general.php for enableTwigSandbox => true. If it is unset or false, the sandbox path is not reachable. Also review which accounts have Control Panel access.","fix":"Upgrade craftcms/cms to 5.11.0 or later (composer update craftcms/cms). Until then, limit Control Panel access to trusted users. The advisory names no other workaround.","status":"open","published_at":"2026-10-19T20:17:54+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:33:03+00:00","updated_at":"2026-10-24T00:20:23+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:33:03Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Craft CMS to 5.11.0 or later.","reach":"internet","title":"Craft CMS: Control Panel users can run code via Twig sandbox escape","impact":"high","summary":"Craft CMS versions 5.0.0 through 5.10.x let an authenticated Control Panel user escape the Twig sandbox by passing unsanitized criteria to getNext, getPrev, or getOwners. That lets them attach malicious Yii event handlers and run code as the web server user.","category":"package","who_cares":["craft-cms","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Code runs as the web user on the server, secrets readable.","analyst_note":"Confirm the fixed version and any workaround from the Craft CMS advisory; the NVD entry is the only source here.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-below-5.0.0","version-5.11.0-or-later","no-control-panel-users-untrusted"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000491,"input_tokens":2955,"output_tokens":391,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any workaround from the Craft CMS advisory; the NVD entry is the only source here.","search":"'-112773':15A,18A '-2026':14A,17A '5.0.0':32B,104C '5.11.0':35B,106C 'achiev':154C 'allow':114C 'appli':77B 'attach':59B,143C 'attack':133C 'authent':37B,115C 'cms':2A,22B,31B,102C 'code':8A,70B,110C,155C 'condit':99B 'config':140C 'contain':107C 'control':3A,38B,116C 'cp':90B 'craft':1A,21B,30B,101C 'craft-cm':20B 'craftcms/cms':19A 'criteria':48B,127C 'cve':13A,16A 'default':84B 'editor':91B 'element':66B,97B,151C 'element-select':96B 'enabletwigsandbox':79B 'escap':12A,42B,120C 'event':62B,145C 'execut':111C,148C,156C 'fals':86B 'getnext':51B,129C 'getown':54B,132C 'getprev':52B,130C 'handler':63B,146C 'host':28B 'inject':135C 'key':58B,141C 'low':88B 'low-privileg':87B 'malici':61B,144C 'packag':23B 'panel':4A,39B,117C 'pass':49B,125C 'php':24B 'privileg':89B 'queri':67B,152C 'rce':25B 'reach':93B 'remot':109C 'rule':100B 'run':7A,69B,153C 'sandbox':11A,45B,123C 'select':98B 'self':27B 'self-host':26B 'set':83B 'true':81B 'twig':10A,29B,44B,122C 'uncleans':47B,126C 'user':5A,40B,74B,118C,160C 'via':9A 'vulner':112C 'web':73B,159C 'yii':55B,136C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112773","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112773","severity":null,"published_at":"2026-10-19T20:17:54+00:00","modified_at":"2026-10-19T22:17:08+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112773:638","url":null,"severity":null,"published_at":"2026-10-24T00:20:23+00:00","modified_at":"2026-10-24T00:20:23+00:00","first_seen_at":"2026-10-24T00:20:23+00:00","fetched_at":"2026-10-24T00:20:23+00:00","note":"Primary: craftcms GHSA-wr79-9v6x-5rfq + 5.11.0 release notes. Key finding: exploitable only when enableTwigSandbox=true (default false) plus CP login. GHSA lists affected '<= 5.11.0' but patched 5.11.0 and CVE says <5.11.0; used <5.11.0. No public PoC or exploitation found; social search skipped (no product-name chatter checked)."}],"documents":[{"id":2552,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-wr79-9v6x-5rfq","title":"GHSA-wr79-9v6x-5rfq: Twig sandbox on/as injection via getNext/getPrev/getOwners","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2549,"url":"https://github.com/craftcms/cms/releases/tag/5.11.0","title":"Craft CMS 5.11.0 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2554,"url":"https://radar.offseq.com/threat/cve-2026-112773-improper-control-of-generation-of-code-code-injection-in-craftcms-cms-0fb224de142e0d51","title":"OffSeq: CVE-2026-112773 (CVSS v4 8.7)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}