Craft CMS EUVD-2026-104576

Exploitation requires an authenticated Craft CMS control panel account (PR:L) with the ability to create or edit element-select condition rules; the attacker abuses the Twig 'group' filter, which uniquely invokes non-string arrow arguments as callables without the checkArrow guard applied to other arrow-accepting filters, passing an array-callable (e.g., FileHelper::writeToFile) to write a webshell into the webroot. The limiting factors are: valid control panel credentials and sufficient privileges to reach the condition-rule functionality, plus a writable webroot for webshell placement. It affects default-configured Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 (no special non-default feature toggle is required beyond the standard control panel). No end-user interaction is needed once the attacker has control panel access.

This is a genuine high-priority vulnerability, though not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and is internally consistent with the description: network-reachable, low complexity, requires some privilege (PR:L), no user interaction, and full compromise of confidentiality, integrity, and availability on the vulnerable system. The critical mitigating signal is PR:L - exploitation requires an authenticated control panel account, so this is not an anonymous internet-facing RCE. That single factor sharply reduces mass-exploitation potential and aligns with a targeted/post-authentication threat model rather than wormable spray-and-pray. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The finding originates from VulnCheck (a credible research source) and is backed by an official GitHub Security Advisory (GHSA-xmwr-88vw-5ghh), which raises confidence in the technical validity even without exploitation telemetry. Net: real and worth prompt patching for any Craft CMS operator who grants control panel access to semi-trusted users, but the authentication precondition means it is a privilege-escalation-to-RCE issue rather than a widespread unauthenticated threat. No signals are directly conflicting; the main gap is the absence of EPSS/KEV/POC data to gauge real-world exploitation likelihood.

An attacker who has (or phishes/compromises) an authenticated Craft CMS control panel account crafts an element-select condition rule that routes through the Twig group filter, supplying an array-callable such as FileHelper::writeToFile as a non-string arrow argument. Because the group filter invokes the arrow argument as a callable without the checkArrow guard, this writes an attacker-controlled PHP webshell into the webroot, which is then requested to execute arbitrary code as the web server user. No public exploit code was identified at time of analysis, but the described technique is concrete and reproducible.