A critical vulnerability in Craft CMS allows authenticated attackers to achieve remote code execution by exploiting improper HMAC signature binding in specific system components.

This vulnerability arises from improper neutralization of special elements in a template engine (CWE-1336). An authenticated user can bypass signature protections by transplanting a signed cookie into a redirect parameter, eventually triggering arbitrary PHP system command execution via an unsandboxed Twig template.

The ability to execute arbitrary operating system commands grants an attacker full control over the web server, leading to potential data exfiltration, lateral movement within the network, and complete system compromise. With a CVSS score of 8.8, this flaw represents a severe risk that could result in significant operational disruption and loss of confidentiality, integrity, and availability.

Immediate Action: Update Craft CMS to version 4.18.6 or 5.10.13 immediately to apply the necessary security patches.

Proactive Monitoring: Review web server access logs for anomalous requests to the license-shun endpoint or unusual usage of the redirect parameter.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to detect and block malicious payloads directed at template engines or suspicious redirects containing serialized cookie data.

Public Exploit Available: Unknown

Given the high CVSS score and the critical nature of remote code execution, organizations must prioritize patching their Craft CMS instances. Administrators should verify their current version and upgrade to the latest secure release, 4.18.6 or 5.10.13, as soon as possible to neutralize this threat.