CVE-2026-109305Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every

Açıklama

Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-vfcw-xv8p-8rj2) vendor-advisory
• VulnCheck Advisory: Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every third-party-advisory