EUVD-2026-41213
GHSA-f74w-488g-8x5r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable entry-save flow with low complexity, but requires an authenticated entry-editing account (PR:L); code execution yields full high C/I/A on the host, scope unchanged.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control. This issue has been fixed in version 5.10.0.
AnalysisAI
Authenticated remote code execution in Craft CMS 5.9.0 through 5.9.x allows control panel users with entry-editing permissions to inject unsandboxed Twig code via the HTTP Referer header during entry save operations. Because the signed redirect URL derived from the attacker-controlled Referer is compiled with renderObjectTemplate() instead of the sandboxed renderSandboxedObjectTemplate(), a low-privileged CMS operator can achieve server-side template injection leading to code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is fixed in Craft CMS 5.10.0.
Technical ContextAI
Craft CMS is a PHP-based content management system that uses the Twig templating engine for rendering dynamic content, including object templates for user-facing strings such as redirect URLs. Craft deliberately provides two rendering paths: renderObjectTemplate(), which evaluates Twig without a security sandbox, and renderSandboxedObjectTemplate(), which restricts access to dangerous functions, filters, and object methods. The vulnerability (CWE-94, Improper Control of Generation of Code / code injection) arises because the entry-save flow compiles the signed redirect URL - whose value is reflected from the attacker-controlled Referer HTTP header - through the non-sandboxed renderObjectTemplate(), so injected Twig expressions execute with full engine capabilities rather than being neutralized by the sandbox. No CPE strings were supplied in the intelligence set, so exact affected configuration entries could not be cross-referenced; affected scope is derived from the vendor advisory version range.
RemediationAI
Vendor-released patch: upgrade to Craft CMS 5.10.0, which replaces the unsandboxed renderObjectTemplate() call with the sandboxed alternative in the entry-save redirect handling; this is the primary and complete fix (advisory: https://github.com/craftcms/cms/security/advisories/GHSA-f74w-488g-8x5r, code change: https://github.com/craftcms/cms/pull/18680). If immediate upgrade is not possible, reduce exposure by tightening control panel permissions so that only fully trusted administrators hold entry-edit rights, since exploitation requires an authenticated editing account - the trade-off is reduced editorial delegation. Additionally, restrict network access to the control panel (e.g., IP allowlisting or VPN-gating the CP path) and consider a WAF rule to strip or sanitize Twig-syntax patterns (such as {{ }} and {% %}) in inbound Referer headers to control panel endpoints, accepting that header-filtering rules can be bypassed and may break legitimate requests, so they are a stopgap rather than a substitute for the patch.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today