Craft CMS EUVD-2026-104578

Requires an authenticated Craft CMS Control Panel account (PR:L) with the ability to supply or render Twig asset transforms - specifically input reaching Asset::getMimeType where attacker-controlled 'as' or 'on' keys flow unfiltered into Craft::createObject. Exploitation is limited to installations running vulnerable versions 5.0.0 through 5.10.x; version 5.11.0 and later are fixed. The primary limiting factor is the authentication requirement: an attacker must first obtain a Control Panel login, so the realistic exposure is concentrated in environments that grant Control Panel access to low-trust or numerous users, or where account credentials can be phished or reused. No special non-default server configuration is implied by the description beyond running an affected Craft 5 version.

This is a credible priority for any organization running Craft CMS, though not a drop-everything emergency absent evidence of active exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.7 (High) and is internally consistent with the description: network-reachable, low complexity, no user interaction, and low privileges (PR:L) corresponding to an authenticated Control Panel user. The VC:H/VI:H/VA:H impact aligns with full remote code execution as the web user (CWE-94, code injection). The key limiting signal is PR:L - exploitation requires a valid, if low-privileged, Control Panel account, which meaningfully narrows the attacker population versus a pre-auth RCE and makes this most dangerous in multi-tenant, agency, or large-editorial deployments where many low-trust Control Panel accounts exist. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. This is NOT in CISA KEV and no POC was supplied, so there is no public exploit identified at time of analysis; the threat is a well-documented sandbox-escape primitive reported by a reputable source (VulnCheck) rather than confirmed in-the-wild activity. Net: patch promptly, prioritizing instances with untrusted or numerous Control Panel users, but it does not require the same urgency as a KEV-listed or unauthenticated flaw.

An attacker with a low-privileged Craft CMS Control Panel account (or one obtained via phishing/credential reuse) crafts a Twig asset transform that abuses Asset::getMimeType, injecting an 'as' or 'on' key that is passed unfiltered to Craft::createObject. This escapes the Twig sandbox to attach a malicious Yii behavior or event handler, resulting in arbitrary PHP code execution as the web server user. No public exploit was identified at time of analysis, so weaponization would require the attacker to reconstruct the technique from the advisory.