Vulnerability in Craftcms Cms
CVE-2026-72781
Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.008 · change: +0.002
Affected products
- Craftcms Cms — versions 5.0.0-RC1, 5.10.7, 4.0.0-RC1
Weakness classification (CWE)
References
- github.com/craftcms/cms/security/advisories/GHSA-f5wm-88jv-g5hx (vendor-advisory)
- www.vulncheck.com/advisories/craft-cms-rc1-before-remote-code-execution-via-twi… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-72781?
- CVE-2026-72781 is a high-severity vulnerability in Craftcms Cms, classified under Protection Mechanism Failure. CVSS score: 8.8/10. Published 2026-08-11.
- How severe is CVE-2026-72781?
- High severity. CVSS v3 base score is 8.8 out of 10.