Craft CMS CVE-2026-109305

Exploitation requires an authenticated Craft CMS control-panel account holding the 'System Messages' permission (a non-admin-grantable permission), running an affected version from 5.10.2 up to but not including 5.10.14. The attacker must supply, within a sandboxed system-message Twig template, a two-argument PHP callable (e.g. passthru or system) invoked via the 'has some' or 'has every' operators, which the sandbox fails to block. The principal limiting factor is the permission gate: an attacker cannot exploit this without first obtaining an account that has been granted System Messages access, so installations that reserve this permission for trusted administrators face materially lower practical risk than multi-user or agency deployments that delegate it. Code executes with the privileges of the web server user, not necessarily root.

This is a genuine RCE but with an important access gate that tempers its real-world urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 8.7 reflect network reach, low complexity, no user interaction, and full VC:H/VI:H/VA:H impact - but PR:L confirms the attacker must already hold an authenticated Craft CMS control-panel account, and the description narrows this further to the specific 'System Messages' permission. This is therefore a privilege-escalation-to-RCE / sandbox-escape issue, not an unauthenticated internet-facing bug. No EPSS score, SSVC decision data, KEV listing, or POC indicator was supplied in the input, so exploitation probability cannot be quantified from the data provided; by the precision rules this is 'no public exploit identified at time of analysis.' Net assessment: a real priority for any Craft deployment that grants System Messages permission to semi-trusted or non-admin users (agencies, multi-author/multi-tenant setups), since it collapses a limited CMS permission into code execution as the web user; lower practical priority for single-admin installs where only fully trusted operators already have equivalent access. Reported by VulnCheck, which also published a dedicated advisory, lending credibility to the finding.

A non-admin content editor who holds the 'System Messages' permission logs into the Craft CMS control panel and edits a system message template, inserting a Twig expression that uses the 'has some' or 'has every' operator to pass a two-argument callable such as passthru or system. When the sandboxed template renders, the callable executes, running arbitrary OS commands as the web server user. No public exploit code was identified in the provided data, and the low attack complexity (AC:L) means no special timing or conditions are needed once the attacker has the required permission.