An authenticated remote code execution vulnerability in Craft CMS poses a critical risk to server integrity and data confidentiality.

This vulnerability involves a failure of the Twig sandbox protection mechanism (CWE-693). An authenticated user with sufficient privileges can bypass sandbox restrictions to perform arbitrary code execution on the host server.

Successful exploitation allows an attacker to gain full control over the web server. This facilitates unauthorized access to sensitive application data, potential lateral movement within the hosting environment, and complete system compromise. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability.

Immediate Action: Update Craft CMS to version 5.10.7 or 4.18.3 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor server access logs and system process execution for unusual activity originating from administrative or user accounts.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the web server process from executing unnecessary system commands or accessing sensitive filesystem areas.

Public Exploit Available: Unknown.

Given the severity of potential remote code execution, organizations must prioritize patching their Craft CMS instances. Administrative teams should verify their current version and apply the recommended updates immediately to prevent exploitation of this sandbox escape.