Craft CMS CVE-2026-79988

Exploitation requires a valid authenticated Craft CMS user account with permissions to author or render Twig templates - for example, a content editor, developer, or contributor role assigned by an administrator. The attacker must have access to a Twig template rendering surface such as a template editor, custom field that evaluates Twig, or equivalent control panel feature. Unauthenticated exploitation is not possible based on PR:L in the CVSS vector. Non-default role configurations that grant Twig template access to untrusted users increase exposure. Exploitation is limited by: requirement for a valid low-privilege authenticated session, access to a Twig rendering context, and the installation running a version prior to 5.10.7. Default installations where non-admin users have template editing rights are fully exploitable without additional prerequisites.

The CVSS 4.0 base score of 8.7 accurately reflects the severity profile: network-accessible, low complexity, no user interaction required, and full impact across confidentiality, integrity, and availability. The most meaningful limiting factor is PR:L - exploitation requires a valid authenticated session, meaning unauthenticated mass exploitation is not possible. However, in typical Craft CMS deployments, content editor and contributor roles are relatively common, meaning the threshold for achieving exploitation is not high for a motivated attacker with social engineering capability or compromised credentials. EPSS data was not provided in the available intelligence, which limits probabilistic exploitation forecasting. No CISA KEV listing is present, and no confirmed public exploit code exists - only a Hackrate hacktivity report of unverified public accessibility. That said, this vulnerability is explicitly described as similar to prior Craft CMS Twig sandbox escapes, meaning actors familiar with the codebase may reconstruct a working exploit with low effort. The absence of KEV and confirmed POC moderately tempers urgency, but the low post-authentication exploitation complexity means patching should not be deferred.

An attacker with a low-privilege Craft CMS account - such as a content editor or contributor - accesses a Twig template rendering surface (e.g., a custom template field or the control panel's template editor) and submits a crafted payload that invokes a dangerous Yii framework method exposed by the misconfigured sandbox. The Twig sandbox fails to block the call, and the server executes arbitrary OS commands with web process privileges. No confirmed public exploit code exists at time of analysis, but the attack pattern mirrors prior Craft CMS Twig sandbox escapes, reducing the development effort for a knowledgeable attacker.