---
id: "CVE-2026-112773"
kind: "vulnerability"
aliases: ["CVE-2026-112773"]
title: "Craft CMS: Control Panel users can run code via Twig sandbox escape"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "craftcms/cms", "fixed": ["5.11.0"], "affected": ">= 5.0.0, < 5.11.0", "ecosystem": "composer"}]
ecosystems: []
tags: ["craft-cms", "package", "php", "rce", "self-hosted", "twig"]
not_affected_if: ["default-config", "managed-hosting", "no-control-panel-users-untrusted", "version-5.11.0-or-later", "version-below-5.0.0"]
published_at: "2026-10-19T20:17:54+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-24T00:20:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112773", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:20:23+00:00"}]
---

# Craft CMS: Control Panel users can run code via Twig sandbox escape

Craft CMS 5.0.0 to before 5.11.0: an authenticated Control Panel user can escape the Twig sandbox through uncleansed criteria passed to getNext, getPrev or getOwners. Yii 'as'/'on' keys attach a malicious event handler to the element query, which runs code as the web user. It only applies when enableTwigSandbox is true; that setting defaults to false. Low-privilege CP editors can reach it through element-select condition rules.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:craftcms/cms affected >= 5.0.0, < 5.11.0 fixed 5.11.0

## How to check

Run 'composer show craftcms/cms' and see whether the version is 5.0.0 to 5.10.x. Then check config/general.php for enableTwigSandbox => true. If it is unset or false, the sandbox path is not reachable. Also review which accounts have Control Panel access.

## Fix

Upgrade craftcms/cms to 5.11.0 or later (composer update craftcms/cms). Until then, limit Control Panel access to trusted users. The advisory names no other workaround.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112773
- 2026-10-24T00:20:23+00:00 analyst — Primary: craftcms GHSA-wr79-9v6x-5rfq + 5.11.0 release notes. Key finding: exploitable only when enableTwigSandbox=true (default false) plus CP login. GHSA lists affected '<= 5.11.0' but patched 5.11.0 and CVE says <5.11.0; used <5.11.0. No public PoC or exploitation found; social search skipped (no product-name chatter checked).

## Documents

- [advisory] GHSA-wr79-9v6x-5rfq: Twig sandbox on/as injection via getNext/getPrev/getOwners https://github.com/craftcms/cms/security/advisories/GHSA-wr79-9v6x-5rfq
- [fix] Craft CMS 5.11.0 release notes https://github.com/craftcms/cms/releases/tag/5.11.0
- [mentions] OffSeq: CVE-2026-112773 (CVSS v4 8.7) https://radar.offseq.com/threat/cve-2026-112773-improper-control-of-generation-of-code-code-injection-in-craftcms-cms-0fb224de142e0d51

## From the sources

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_