Authenticated low-privilege users can achieve full server compromise in Craft CMS versions 5.10.0 through 5.10.12 by exploiting an unsandboxed template rendering sink.

This vulnerability involves Improper Control of Generation of Code, specifically Server-Side Template Injection (SSTI). An authenticated user with low-level control panel access can leverage an unsandboxed sink to execute arbitrary PHP code on the underlying server.

The potential impact of this vulnerability is critical, as it allows for full server compromise by an authenticated attacker. With the ability to execute arbitrary PHP code, an attacker could gain complete control over the web application, exfiltrate sensitive data, or pivot into the internal network. Given the CVSS score of 8.8, this flaw presents a severe risk to organizational data integrity and system availability.

Immediate Action: Update Craft CMS to version 5.10.13 or later immediately to resolve the vulnerable template rendering mechanism.

Proactive Monitoring: Review web application logs for suspicious POST requests targeting the control panel, particularly those involving redirect parameters or unexpected Twig syntax.

Compensating Controls: Implement strict access control lists for the Craft CMS control panel and utilize a Web Application Firewall (WAF) to detect and block common SSTI payloads.

Public Exploit Available: Unknown.

Organizations running affected versions of Craft CMS must prioritize patching to version 5.10.13. Because this vulnerability allows low-privileged authenticated users to execute arbitrary code, the security of the control panel is paramount. Administrators should audit user permissions and ensure that only trusted personnel have access to the dashboard until the update is successfully applied.