An authenticated remote code execution vulnerability in Craft CMS allows attackers with control panel access to execute arbitrary code due to an insecure Twig sandbox configuration.

This is a protection mechanism failure (CWE-693) where the Twig sandbox improperly allowlists classes, enabling access to dangerous Yii framework function-call gadgets. An authenticated user with permission to access the control panel can trigger this flaw by rendering a malicious Twig template.

Successful exploitation allows an attacker to achieve remote code execution on the underlying server, leading to total compromise of the application and its data. Given the CVSS score of 8.7, this represents a high-severity risk that could result in complete loss of confidentiality, integrity, and availability for the affected system.

Immediate Action: Update Craft CMS to version 4.18.3 or 5.10.7 immediately to apply the patch that restricts dangerous class access within the Twig sandbox.

Proactive Monitoring: Review application logs for suspicious template rendering activities or unauthorized access to the control panel by low-privileged user accounts.

Compensating Controls: Restrict access to the Craft CMS control panel to trusted administrative users only and utilize a Web Application Firewall to filter requests containing suspicious Twig syntax or payloads.

Public Exploit Available: Unknown

Organizations running the affected versions of Craft CMS must prioritize patching to the latest versions. The ability for an authenticated user to achieve remote code execution presents a significant security risk that should be mitigated immediately to prevent potential system-wide compromise.