EUVD-2026-93362
GHSA-x658-h3pq-chcg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CP action, low complexity, only a basic authenticated account needed (PR:L), yielding OS command execution with full C/I/A impact; scope unchanged as impact stays within the host process.
Primary rating from Vendor (Hackrate).
CVSS VectorVendor: Hackrate
Lifecycle Timeline
4DescriptionCVE.org
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.
Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().
This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.
The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.
Articles & Coverage 1
AnalysisAI
Authenticated remote code execution in Craft CMS 5.10.13.2 allows any low-privilege Control Panel user to run operating-system commands as the PHP/web-server process by injecting Twig through the app/render-components action. The attack requires only basic CP access; a non-admin Team user with no optional permissions was shown to override an EntryType uiLabelFormat and trigger an Entry render that evaluates attacker-controlled Twig via renderObjectTemplate(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Control Panel account on Craft CMS - but the privilege bar is minimal: the description confirms a non-admin Team user with NO optional permissions (no entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment-variable access) can exploit it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible, high-priority vulnerability that should be patched promptly despite lacking exploitation telemetry. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Craft CMS 5.11.0, the referenced fixed release, and follow the vendor advisory GHSA-g48f-wc2q-4rrv for exact patched versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Craft CMS instances, confirm whether any run 5.10.13.2, and restrict Control Panel access to essential trusted accounts by disabling or demoting non-admin Team users, enforcing least privilege, and placing the CP behind VPN or IP allowlisting where feasible; review CP and application logs for app/render-components calls, EntryType uiLabelFormat changes, and renderObjectTemplate activity, and alert on those events. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today