CVE-2026-112773

8.8High

Published 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-94

Impact

Authenticated Control Panel users can execute arbitrary code as the web user by escaping the Twig sandbox. They need valid credentials to access the Craft CMS Control Panel.

Root cause

Uncleansed criteria passed to getNext, getPrev, or getOwners allow injection of Yii 'as' or 'on' configuration keys to attach malicious event handlers during element query execution.

Affected systems

Craft CMS 5.0.0 before 5.11.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Craft CMS to version 5.11.0 or later. If patching must wait, restrict Control Panel access to trusted administrators and limit Twig template editing permissions.

shell

$ composer update craftcms/cms:^5.11.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112773