CVE-2026-109305 Overview
CVE-2026-109305 is a Twig sandbox bypass in Craft CMS versions 5.10.2 through 5.10.13. The vulnerability allows non-admin users with the System Messages permission to invoke arbitrary PHP callables from sandboxed templates. Attackers can abuse the has some and has every operators to supply two-argument callables such as passthru or system, executing operating system commands as the web server user. The flaw maps to [CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine].
Critical Impact
Authenticated low-privileged users can achieve remote code execution on the web server, leading to full compromise of the Craft CMS host and underlying application data.
Affected Products
- Craft CMS 5.10.2
- Craft CMS versions after 5.10.2 and before 5.10.14
- Craft CMS installations where non-admin accounts hold the System Messages permission
Discovery Timeline
- 2026-10-12 - CVE-2026-109305 published to the National Vulnerability Database (NVD)
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109305
Vulnerability Analysis
Craft CMS uses the Twig template engine with a sandbox extension that restricts which functions, filters, and methods templates can call. System Messages templates are rendered inside this sandbox because non-admin users with the System Messages permission can edit them.
The has some and has every operators accept a callable as their right-hand operand. In vulnerable builds, the sandbox fails to validate callables passed to these operators. An attacker can therefore reference arbitrary PHP functions, including those that spawn OS processes, and have Twig invoke them during template evaluation.
Because the callable is invoked with two arguments, functions such as passthru, system, and exec match the expected signature. The template engine executes the function and returns control flow to the attacker-supplied input, producing command execution under the web server account.
Root Cause
The root cause is an incomplete allowlist in the Twig sandbox policy applied by Craft CMS. The policy evaluates calls made through standard function and method syntax but does not inspect callables supplied as operands to the has some and has every iterator operators. This gap lets sandboxed templates reach PHP functions that the sandbox was designed to block.
Attack Vector
An authenticated user with the System Messages permission edits a System Message template and inserts a Twig expression that uses has some or has every with a dangerous PHP callable such as passthru or system. When the message is rendered, Craft evaluates the expression and executes the attacker-chosen command on the server. The attack is remote, requires low privileges, and needs no user interaction. See the Craft CMS GitHub Security Advisory and the VulnCheck Advisory on Craft CMS for additional technical analysis.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-109305
Indicators of Compromise
- System Message templates containing the keywords has some or has every combined with PHP function names such as passthru, system, exec, shell_exec, or proc_open.
- Child processes of the PHP-FPM or web server process (php-fpm, httpd, nginx) spawning shells (/bin/sh, /bin/bash) or network utilities.
- Unexpected outbound network connections originating from the Craft CMS web user.
- Modifications to project/config or System Message records by non-admin accounts.
Detection Strategies
- Audit the Craft CMS database and project/config for System Message content that references Twig iterator operators paired with callable strings.
- Review web server access logs for authenticated requests to System Message editing and preview endpoints from non-admin users.
- Correlate PHP process execution telemetry with user session identifiers to attribute suspicious shell invocations to a specific Craft account.
Monitoring Recommendations
- Enable process-execution telemetry on web servers hosting Craft CMS and alert on web-user child processes that are not part of normal application behavior.
- Monitor the Craft CMS admin audit log for assignment of the System Messages permission to non-admin user groups.
- Alert on file writes to web-accessible directories by the PHP runtime user outside normal deployment windows.
How to Mitigate CVE-2026-109305
Immediate Actions Required
- Upgrade Craft CMS to version 5.10.14 or later on all affected installations.
- Review the user and group assignments for the System Messages permission and revoke it from any account that does not require it.
- Inspect existing System Message templates for malicious Twig expressions using has some or has every with PHP function names.
- Rotate credentials, API keys, and session tokens stored on or accessible to the Craft CMS server if compromise is suspected.
Patch Information
Craft CMS 5.10.14 contains the fix. Administrators should update using Composer or their standard deployment pipeline. Refer to the Craft CMS GitHub Security Advisory GHSA-vfcw-xv8p-8rj2 for the official patch details and version matrix.
Workarounds
- Temporarily remove the System Messages permission from all non-admin user groups until patching is complete.
- Restrict access to the Craft control panel to trusted networks using IP allowlisting at the web server or reverse proxy.
- Enforce strong authentication, including multi-factor authentication, for all users that retain Craft control panel access.
# Upgrade Craft CMS to the patched release using Composer
composer require craftcms/cms:^5.10.14 --update-with-dependencies
php craft up
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
