Craft CMS: Sandbox escape in element search leads to remote code execution
Summary
Craft CMS 4 and 5 before the fixed releases allow any authenticated control panel user to escape the Twig sandbox through an element-search condition. The attacker can recover the GeneralConfig::securityKey through a character oracle, sign parameters offline and reach unsandboxed PHP callables, which can execute attacker-selected functions as the web server user. Exploitation requires a valid control panel account, and enabling the sandbox alone does not protect a site.
Affected
- craftcms/cms 5.0.0 to before 5.11.2
- craftcms/cms 4.0.0 to before 4.18.9
- The CVE record states 'default: unaffected'; this is not explained further.
Fixed in
- Craft CMS 5.11.2 or later
- Craft CMS 4.18.9 or later
Workaround
Unknown.
Exploitation
- Requires an authenticated control panel user with low privileges.
- No in-the-wild exploitation found in the research notes.
- The regression test uses a harmless callback and does not execute OS commands.
Our recommendation
- Update to Craft CMS 5.11.2 or 4.18.9, depending on the installed major version, without delay.
- Until patched, limit control panel access to trusted users.
- Review control panel user accounts and recent logins for unexpected activity.
- Keep the sandbox enabled, but do not rely on it as the only protection.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Craft CMS GitHub repository github.com
- Craft CMS release 5.11.2 github.com
- GitHub Security Advisory GHSA-v4q3-2g5g-wjj6 github.com
- HCKRT write-up HCKRT-DRNL9W www.hckrt.com
- Craft CMS Security FAQ craftcms.com
- Craft CMS supported versions craftcms.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:24.
Original description (NVD)
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists. The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle. After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.