Craft CMS EUVD-2026-104579

Requires an authenticated Craft CMS Control Panel account (PR:L) on a version from 5.0.0 up to but not including 5.11.0; no end-user interaction is needed (UI:N). The specific trigger is passing uncleansed/attacker-controlled criteria into the getNext, getPrev, or getOwners element-query methods, allowing injection of Yii framework 'as' (behavior) or 'on' (event) configuration keys that attach a malicious event handler executed when the element query runs. The principal limiting factor is the Control Panel authentication requirement - exploitation is impossible for fully unauthenticated attackers, so real-world risk is driven by how broadly and to how low-trust a population CP accounts are granted; the Twig sandbox (normally a protective boundary for less-trusted template authors) is the control being escaped.

This is a genuinely serious but not drop-everything-now issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) correctly reflects remote, low-complexity code execution that nonetheless requires authentication - PR:L means an attacker needs a valid Control Panel account, which is the single most important risk-limiting factor. The description confirms this: exploitation is limited to 'authenticated Control Panel users,' so this is a privilege-escalation/sandbox-escape primitive, not an unauthenticated internet-facing RCE. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit was referenced, so the status is 'no public exploit identified at time of analysis.' The signals are internally consistent (CVSS network vector matches the HTTP-based Control Panel, PR:L matches the authenticated requirement), so there is no contradiction to flag - the chief caveat is simply that CP access is required, which in well-run deployments is restricted to trusted content editors and admins. Prioritize patching where untrusted or low-trust users hold CP accounts; deprioritize relative to unauthenticated RCEs where CP access is tightly held.

An attacker who has obtained a low-privileged Craft CMS Control Panel account (e.g., a content author, or a compromised editor credential) crafts an element query that passes uncleansed criteria into getNext, getPrev, or getOwners, injecting Yii 'as'/'on' configuration keys to attach a malicious event handler. When the element query executes, the handler runs attacker-controlled code as the web server user, escaping the Twig sandbox. No public exploit code was referenced, but the described technique is concrete and reliably reproducible by a skilled attacker.