{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/craft-cms-5.10.2---5.10.13/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-109305"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Craft CMS (5.10.2 - 5.10.13)","Craft CMS (4.0.0-4.18.6)","Craft CMS (5.0.0-5.10.13)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Craft CMS"],"content_html":"\u003cp\u003eCraft CMS versions 5.10.2 through 5.10.13 are vulnerable to a Twig sandbox bypass caused by improper validation of the \u0026quot;has some\u0026quot; and \u0026quot;has every\u0026quot; operators. This vulnerability allows an authenticated attacker possessing the \u0026quot;System Messages\u0026quot; permission to bypass the Twig sandbox environment and invoke arbitrary PHP callables. By providing specifically crafted two-argument callables such as 'system' or 'passthru' within sandboxed template fields, an attacker can achieve remote code execution (RCE) in the context of the web server process. This vulnerability is highly critical due to the ease of exploitation by authenticated users with limited privileges, potentially leading to full compromise of the underlying web application environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized code execution on the web server, which can lead to data exfiltration, system-wide compromise, and lateral movement within the hosting infrastructure. The vulnerability affects all Craft CMS installations within the specified version range.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Craft CMS to version 5.10.14 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit all user accounts possessing the \u0026quot;System Messages\u0026quot; permission to identify and minimize accounts with excessive privileges.\u003c/li\u003e\n\u003cli\u003eReview web server logs for suspicious POST requests containing Twig-related keywords or system command patterns (e.g., system, passthru, exec) submitted via template editing interfaces.\u003c/li\u003e\n\u003cli\u003eImplement stricter access controls and monitor template modification activities within the administrative interface.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:34:48Z","date_published":"2026-10-12T18:34:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-twig-bypass/","summary":"Craft CMS versions 5.10.2 through 5.10.13 contain a Twig sandbox bypass vulnerability allowing non-admin users with System Messages permissions to execute arbitrary PHP code.","title":"Craft CMS Twig Sandbox Bypass (CVE-2026-109305)","url":"https://feed.craftedsignal.io/briefs/2026-10-twig-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Craft CMS (5.10.2 - 5.10.13)","version":"https://jsonfeed.org/version/1.1"}