Vulnerability in Craftcms Cms
CVE-2026-105985
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate(). This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process. The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- 7004884b-51e2-48e8-b4a2-5ca29e80453e (technical-description, mitigation, third-party-advisory)
- 7004884b-51e2-48e8-b4a2-5ca29e80453e (release-notes)
- 7004884b-51e2-48e8-b4a2-5ca29e80453e (product)
- 7004884b-51e2-48e8-b4a2-5ca29e80453e (third-party-advisory)
Frequently asked questions
- What is CVE-2026-105985?
- CVE-2026-105985 is a high-severity vulnerability in Craftcms Cms, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 8.8/10. Published 2026-10-06.
- How severe is CVE-2026-105985?
- High severity. CVSS v3 base score is 8.8 out of 10.