Craft CMS: Remote code execution via Twig sandbox escape
Summary
Craft CMS from 5.0.0 before 5.11.0 allows authenticated Control Panel users to escape the Twig sandbox through the getNext, getPrev and getOwners element methods. An attacker can inject Yii behavior or event handler configuration that runs code when the element query executes, which results in code execution as the web user. The sandbox must be enabled (enableTwigSandbox, default off) for the attack to be possible.
Affected
- Craft CMS 5.0.0 to before 5.11.0
- Craft CMS sites with enableTwigSandbox set to true and Control Panel accounts with access to the affected features
Fixed in
- Craft CMS 5.11.0 (according to the CVE record and the affected range; not yet confirmed in the vendor advisory)
Workaround
Unknown.
- Keep enableTwigSandbox disabled if it is not required (vendor advisory not verified)
Exploitation
- Authentication with Control Panel access is required.
- CISA KEV: not listed.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found for this CVE: Unknown.
Our recommendation
- Upgrade Craft CMS to 5.11.0 or later, after taking a backup.
- Limit Control Panel accounts to trusted staff and remove unused accounts.
- Enforce MFA on Control Panel logins and restrict Control Panel access by IP where feasible.
- Check whether enableTwigSandbox is enabled and review Control Panel user activity for anomalies.
- Prioritise sites with external Control Panel access or several untrusted editors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wr79-9v6x-5rfq github.com
- VulnCheck Advisory: Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection www.vulncheck.com
- OSV CVE-2026-112773 mirror vulners.com
- Strix CVE-2026-112773 www.strix.ai
- GitHub Security – craftcms/cms github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:00.
Original description (NVD)
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.