Improper Neutralization of Special Elements Used in a Template Engine in Craft CMS - #VU159603
Published: November 6, 2026
Vulnerability identifier: #VU159603
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1336
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated control panel user to execute attacker-selected PHP callables as the web server user.
The vulnerability exists due to property lookups bypassing Twig sandbox restrictions when Craft CMS evaluates an element-search condition as an object template. An authenticated control panel user can submit crafted conditions to recover the securityKey through observable search results, then forge signed parameters that reach unsandboxed template rendering and invoke PHP callables.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - addressed in versions 4.18.9, 5.11.2