Skip to main content

Craft CMS EUVDEUVD-2026-67081

| CVE-2026-79988 HIGH
Protection Mechanism Failure (CWE-693)
2026-08-27 Hackrate GHSA-9fvq-jx89-q558
Information Disclosure Cms
8.7
CVSS 4.0 · Vendor: Hackrate
Share

Severity by source

Vendor (Hackrate) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-accessible sandbox escape requiring only a low-privilege authenticated account; no scope change as impact is contained to the vulnerable Craft CMS system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Hackrate).

CVSS VectorVendor: Hackrate

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 27, 2026 - 18:02 EUVD
Source Code Evidence Fetched
Aug 27, 2026 - 17:57 vuln.today
Analysis Generated
Aug 27, 2026 - 17:57 vuln.today
CVE Published
Aug 27, 2026 - 15:36 cve.org
HIGH 8.7

DescriptionCVE.org

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

AnalysisAI

Remote code execution in Craft CMS allows authenticated users with Twig template access to escape the sandbox via permissive Yii framework functionality, achieving full confidentiality, integrity, and availability compromise on the host system. The root cause is CWE-693 (Protection Mechanism Failure): the Twig sandbox policy was configured to permit dangerous Yii framework methods capable of executing arbitrary code, rather than enforcing a tight allowlist. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege Craft CMS credentials
Delivery
Access Twig template rendering surface
Exploit
Submit payload invoking dangerous Yii framework method
Execution
Twig sandbox fails to block restricted call
Impact
Arbitrary code executes with web server privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated Craft CMS user account with permissions to author or render Twig templates - for example, a content editor, developer, or contributor role assigned by an administrator. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.7 accurately reflects the severity profile: network-accessible, low complexity, no user interaction required, and full impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privilege Craft CMS account - such as a content editor or contributor - accesses a Twig template rendering surface (e.g., a custom template field or the control panel's template editor) and submits a crafted payload that invokes a dangerous Yii framework method exposed by the misconfigured sandbox. The Twig sandbox fails to block the call, and the server executes arbitrary OS commands with web process privileges. …
Remediation The primary remediation is to upgrade Craft CMS to version 5.10.7 or later, which introduces `craft\web\twig\AllowableInSandbox` to enforce a restrictive Twig sandbox policy that excludes dangerous Yii framework functionality. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Audit Craft CMS user permissions and restrict Twig template editing access to only essential administrators; disable inactive accounts with these privileges. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cms

View all
CVE-2020-7357 CRITICAL POC
9.9 Aug 06

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
CVE-2012-4405 MEDIUM
6.8 Sep 18

Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
CVE-2021-47753 CRITICAL POC
9.8 Jan 15

phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
CVE-2019-9874 CRITICAL POC
9.8 May 31

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
CVE-2019-9875 HIGH POC
8.8 May 31

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
CVE-2012-5894 HIGH POC
7.5 Nov 17

SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
CVE-2012-5893 MEDIUM POC
6.8 Nov 17

Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
CVE-2015-2083 MEDIUM POC
6.8 Feb 25

Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
CVE-2012-5919 MEDIUM POC
4.3 Nov 19

Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
CVE-2025-5429 MEDIUM POC
6.3 Jun 02

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
CVE-2025-5428 MEDIUM POC
6.3 Jun 02

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
CVE-2025-5427 MEDIUM POC
6.3 Jun 02

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2013-0431 MEDIUM POC
5.3
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-67081 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy