CVE-2025-57811: Craft CMS Twig SSTI RCE Vulnerability

CVE-2025-57811 Overview

Craft CMS contains a Server-Side Template Injection (SSTI) vulnerability in its Twig template engine that can lead to remote code execution. The flaw affects Craft CMS versions 4.0.0-RC1 through 4.16.5 and 5.0.0-RC1 through 5.8.6. This issue is a follow-up to CVE-2024-52293, indicating an incomplete fix in the original sandbox restrictions. Authenticated attackers with high privileges can leverage the call_user_func function passed as an arrow to Twig filters or functions, bypassing the existing denylist and executing arbitrary PHP code on the server. Craft CMS released patched versions 4.16.6 and 5.8.7 to remediate the vulnerability [CWE-1336].

Critical Impact
Successful exploitation grants attackers arbitrary PHP code execution within the Craft CMS application context, resulting in full compromise of content, configuration, and underlying server resources.

Affected Products

Craft CMS versions 4.0.0-RC1 through 4.16.5
Craft CMS versions 5.0.0-RC1 through 5.8.6
All editions running vulnerable Twig extension code in src/web/twig/Extension.php

Discovery Timeline

2025-08-25 - CVE-2025-57811 published to NVD
2025-09-03 - Last updated in NVD database

Technical Details for CVE-2025-57811

Vulnerability Analysis

The vulnerability resides in Craft CMS's Twig extension layer, which enforces a denylist of dangerous PHP functions that cannot be invoked via arrow callbacks in Twig filters and functions. The original CVE-2024-52293 fix introduced this denylist to block functions such as system, exec, passthru, file_get_contents, file_put_contents, and popen. The denylist omitted call_user_func, a PHP function that invokes any callable by name. Attackers with template editing capabilities can pass call_user_func as an arrow to filters like map, filter, or reduce, then supply a forbidden function name as the argument to indirectly execute it. This effectively neutralizes the sandbox and reopens the Twig SSTI to RCE attack path.

Root Cause

The root cause is an incomplete sandbox denylist [CWE-1336] in src/web/twig/Extension.php. The checkArrow validation logic did not account for indirect function invocation through call_user_func, allowing attackers to dispatch any callable string and bypass intended restrictions on dangerous PHP functions.

Attack Vector

Exploitation requires network access to the Craft CMS application and an account with privileges to author or modify Twig templates. The attacker crafts a Twig expression that passes call_user_func as the arrow argument to a filter, then supplies the target function name and parameters. Because the denylist did not include call_user_func, the underlying validation accepts the arrow and dispatches the payload at render time.

php

                'file_get_contents',
                'file_put_contents',
                'popen',
+                'call_user_func',
            ])
        ) {
            throw new RuntimeError(sprintf('The "%s" %s does not support passing "%s".', $thing, $type, $arrow));

Source: Craft CMS commit e77f8a2 — the patch adds call_user_func to the denylist, causing checkArrow to throw a RuntimeError when this function is passed as an arrow to a Twig filter or function.

Detection Methods for CVE-2025-57811

Indicators of Compromise

Twig template content or stored template fields containing the string call_user_func passed as an arrow argument to filters such as map, filter, reduce, or sort.
Unexpected PHP processes spawned by the web server user (php-fpm, www-data) shortly after authenticated CMS template edits.
Outbound network connections originating from the Craft CMS web application to unfamiliar hosts following template render events.

Detection Strategies

Review Craft CMS audit logs and database tables holding template content for arrow expressions referencing call_user_func or other PHP callables.
Inspect web server access logs for POST requests to Craft control panel endpoints that modify Twig templates, correlated with non-administrator accounts.
Hunt for anomalous child processes of the PHP runtime that execute shells, network utilities, or file system enumeration tools.

Monitoring Recommendations

Enable verbose application logging on Craft CMS and forward template modification events to a centralized log platform.
Alert on creation or modification of Twig templates by accounts that do not normally perform such actions.
Monitor egress traffic from web servers hosting Craft CMS for connections to unrecognized IP addresses or domains.

How to Mitigate CVE-2025-57811

Immediate Actions Required

Upgrade Craft CMS to version 4.16.6 (for the 4.x branch) or 5.8.7 (for the 5.x branch) without delay.
Audit all administrative and content author accounts that hold template editing permissions and revoke unnecessary privileges.
Review existing Twig templates for malicious arrow expressions referencing call_user_func or other indirect call mechanisms.

Patch Information

Craft CMS published the fix in pull request #17612 and commit e77f8a2. The patch extends the arrow denylist in src/web/twig/Extension.php to include call_user_func, blocking the indirect invocation path. Full details are available in the GHSA-crcq-738g-pqvc advisory.

Workarounds

Restrict template editing permissions to a minimal set of trusted administrators until the patched version is deployed.
Place Craft CMS administrative endpoints behind network controls such as VPN access or IP allowlisting.
Implement a web application firewall rule that inspects template submission payloads for call_user_func and other suspicious PHP callables.

bash

# Verify installed Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.8.7 --update-with-dependencies
php craft up