CVE-2026-72781: Craft CMS Twig Sandbox RCE Vulnerability

CVE-2026-72781 Overview

CVE-2026-72781 is a remote code execution vulnerability in Craft CMS affecting versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3. The flaw resides in the Twig sandbox mechanism [CWE-693: Protection Mechanism Failure]. Craft marks the ElementInterface as safe through the AllowedInSandbox attribute, and the sandbox allowlisting extends across the entire class hierarchy from craft\base\Component up to yii\base\Component. Authenticated attackers with control panel access can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget. The exploit succeeds even when the Twig sandbox is explicitly enabled through enableTwigSandbox().

Critical Impact
An authenticated control panel user can execute arbitrary code on the Craft CMS server by rendering a crafted Twig template, defeating the sandbox protection mechanism.

Affected Products

Craft CMS versions >= 5.0.0-RC1 before 5.10.7
Craft CMS versions >= 4.0.0-RC1 before 4.18.3
Installations that rely on enableTwigSandbox() for template isolation

Discovery Timeline

2026-08-11 - CVE-2026-72781 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72781

Vulnerability Analysis

Craft CMS renders Twig templates through a sandbox that is intended to restrict which classes, methods, and properties untrusted templates can access. The sandbox uses an AllowedInSandbox attribute to whitelist safe interfaces such as ElementInterface. The allowlist propagates through inheritance, meaning any class implementing the interface, and all of its ancestors, become reachable from within a sandboxed template. Because Craft's element classes extend craft\base\Component, which in turn extends yii\base\Component, the entire Yii component base class is exposed. yii\base\Component supports behaviors and event handlers that allow arbitrary callables to be invoked, providing a well-known gadget for turning method access into arbitrary function execution.

Root Cause

The root cause is an over-broad protection mechanism. The AllowedInSandbox attribute on ElementInterface was not scoped to the interface itself and cascades up the class hierarchy. Sandbox enforcement therefore trusts framework internals that were never intended to be reachable from user-controlled templates. This is a classic protection mechanism failure classified under CWE-693.

Attack Vector

Exploitation requires an authenticated user with permission to access the Craft control panel and edit or render Twig templates. The attacker submits a Twig template that navigates from an allowed element object through the exposed component hierarchy to the arbitrary function-call gadget in yii\base\Component. When Craft renders the template, the gadget executes an attacker-supplied callable in the context of the web server. No verified proof-of-concept code is public. See the GitHub Security Advisory and the VulnCheck Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-72781

Indicators of Compromise

Twig templates referencing yii\base\Component, attachBehavior, attachBehaviors, on, or trigger in unusual contexts
Newly created or modified templates under the Craft templates/ directory authored by control panel users
Web server processes spawning unexpected child processes such as sh, bash, php -r, or curl shortly after template rendering
Outbound network connections initiated by the PHP-FPM or web server worker to unfamiliar hosts

Detection Strategies

Audit Craft control panel activity logs for template edits and previews performed by non-administrator accounts
Inspect Twig template content for reflection-style access to Yii component methods and behavior attachment
Correlate PHP process telemetry with template render events to identify anomalous command execution
Alert on new file writes to web-accessible directories originating from PHP worker processes

Monitoring Recommendations

Forward web server, PHP-FPM, and application logs to a centralized analytics platform for retention and correlation
Monitor for changes to Craft configuration values controlling enableTwigSandbox and template roots
Track authentication events and privilege changes for control panel users with template access

How to Mitigate CVE-2026-72781

Immediate Actions Required

Upgrade Craft CMS 5.x installations to 5.10.7 or later
Upgrade Craft CMS 4.x installations to 4.18.3 or later
Review and revoke unnecessary control panel permissions, especially template editing rights
Rotate session tokens, API keys, and secrets accessible to the web server if compromise is suspected

Patch Information

Craft CMS resolved the issue in versions 5.10.7 and 4.18.3 by tightening the sandbox allowlist so that inherited framework classes are no longer implicitly reachable. Refer to the GitHub Security Advisory GHSA-f5wm-88jv-g5hx for the official fix details and upgrade guidance.

Workarounds

Restrict control panel access to fully trusted administrators until patches can be applied
Disable custom Twig template editing for lower-privileged user groups
Place the Craft admin interface behind an IP allowlist or VPN to reduce the attacker population
Deploy web application firewall rules that block requests containing Yii behavior or event gadget patterns in template payloads

bash

# Upgrade Craft CMS to a patched release using Composer
composer require craftcms/cms:^5.10.7 -w
# or for the 4.x branch
composer require craftcms/cms:^4.18.3 -w
php craft up