Craft CMS: Twig sandbox bypass leading to remote code execution
Summary
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass in the "has some" and "has every" operators. Users with the System Messages permission can use two-argument PHP callables such as passthru or system in sandboxed templates to execute code as the web user. The issue only applies to sites where enableTwigSandbox is enabled, which the official starter project does by default.
Affected
- Craft CMS 5.10.2 up to, but not including, 5.10.14
- Only sites with enableTwigSandbox enabled are affected by the sandbox bypass
Fixed in
- Craft CMS 5.10.14 (fixes this vulnerability; also covers CVE-2026-109306 and CVE-2026-109304)
Workaround
- Unknown. No vendor-documented workaround.
- Disabling the sandbox is not a fix: a system-messages editor could then reach the application directly.
- Limit the System Messages permission and review Control Panel access.
Exploitation
- Exploited in the wild: Unknown. Sources reviewed do not mark it as known exploited.
- Public proof of concept: none found in research; this does not prove none exists.
- EPSS: about 0.005 according to one aggregator.
Our recommendation
- Inventory all Craft CMS installations and identify those on 5.10.2 to 5.10.13.
- Upgrade to Craft CMS 5.10.14 or later.
- Check whether enableTwigSandbox is set and review who holds System Messages and Control Panel access.
- Review logs for unusual template edits by low-privileged users.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vfcw-xv8p-8rj2 github.com
- VulnCheck advisory www.vulncheck.com
- Craft CMS 5.10.14 release github.com
- OSV CVE-2026-109306 osv.dev
- GitHub Advisory GHSA-52mh-mf22-cc6j github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:50.
Original description (NVD)
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.