Protection mechanism failure in Craft CMS - CVE-2026-72781
Published: July 29, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU139966
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72781
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to a protection mechanism failure in the Twig sandbox SecurityPolicy class when rendering a user-defined Twig template. A remote user can render a malicious Twig template to execute arbitrary code.
Exploitation requires permission to access the control panel, and the issue can be triggered even when the Twig sandbox is enabled through enableTwigSandbox().
Affected software
Craft CMS
How to mitigate CVE-2026-72781
Install security update from vendor's website.
Craft CMS - addressed in versions 4.18.3, 5.10.7