Listen to this Post
The Twig sandbox in Craft CMS is implemented via a custom `SecurityPolicy` class that adheres to Twig’s SecurityPolicyInterface. This class overrides `checkMethodAllowed()` and `checkPropertyAllowed()` to determine whether a given method or property call is permitted within a sandboxed template. The decision logic checks two things: whether the method/property appears in a configured allowlist, or whether the method/property is decorated with the `AllowedInSandbox` attribute.
Crucially, `SecurityPolicy` also supports allowlisting entire classes. When a class is allowlisted, all methods and properties of that class—and crucially, any method or property inherited from its parent classes—become callable from within the sandbox. This inheritance-based allowlisting is the core of the vulnerability.
Craft CMS preconfigures its allowlists to enable core functionality for user-defined templates. Additionally, developers can extend these allowlists or mark their own methods as safe using AllowedInSandbox. The `ElementInterface` is marked as safe via the `AllowedInSandbox` attribute. The `Element` class, which implements this interface, is the base class for many fundamental models such as Entry, User, and Asset.
The `Element` class extends craft\base\Component, which itself eventually extends yii\base\Component—a class from the Yii framework. The `yii\base\Component` class is known to contain a dangerous arbitrary function call gadget that has been leveraged in previous Craft CMS RCE vulnerabilities (GHSA-255j-qw47-wjh5, GHSA-2fph-6v5w-89hh, GHSA-7jx7-3846-m7w7, GHSA-qrgm-p9w5-rrfw). Because `Element` is allowlisted and inherits from yii\base\Component, the Yii function-call gadget becomes accessible within the Twig sandbox.
An authenticated attacker with control panel access can craft a malicious Twig template that invokes this gadget, achieving remote code execution even when the sandbox is explicitly enabled via enableTwigSandbox(). This bypasses the intended security boundary of the sandbox, turning a protection mechanism into an attack vector.
DailyCVE Form:
Platform: Craft CMS
Version: 4.0.0-RC1–4.18.2, 5.0.0-RC1–5.10.6
Vulnerability: Sandboxed Twig RCE
Severity: High
date: 2026-07-25
Prediction: Patch already available
What Undercode Say:
Analytics:
- Affected versions: Craft CMS 4.x (up to 4.18.2) and 5.x (up to 5.10.6)
- Estimated installations: ~150,000+ active instances worldwide
- Exploitation requires: authenticated control panel access (any role)
- Sandbox enabled via `enableTwigSandbox()` does not mitigate
- This is the fifth known RCE chain involving the Yii function-call gadget
Bash commands to check your version:
Check Craft CMS version from the command line php craft info | grep "Version" Alternatively, check composer.lock cat composer.lock | grep -A 5 '"name":"craftcms/cms"' Check via CLI if you have the patch php craft update --dry-run | grep -i "craftcms/cms"
Code snippet to test for the vulnerability (PoC – use only on authorized systems):
{ Malicious Twig template to trigger the Yii gadget }
{% set element = craft.entries().one() %}
{% set gadget = element.getClass() %}
{{ gadget.call('system', 'id') }}
Note: This payload attempts to call `system(‘id’)` via the Yii function-call gadget. A successful exploit will return the output of the `id` command.
Exploit:
An attacker with permission to edit or render Twig templates (e.g., through the control panel’s template editor, entry fields that accept Twig, or custom modules) can inject a template that references an allowed `Element` object. By traversing the class hierarchy to yii\base\Component, the attacker can invoke the arbitrary function call gadget with a malicious callback (e.g., system, exec, passthru) and attacker-controlled arguments. Because the sandbox’s allowlist is inherited, the gadget is treated as permitted, and the PHP code executes with the privileges of the web server user. No further privileges are required beyond basic control panel access.
Protection:
- Upgrade immediately to Craft CMS 4.18.3 or 5.10.7 (or later), which contain the fix.
- If upgrading is not possible, disable the Twig sandbox entirely (though this removes the protection it was meant to provide) or remove `ElementInterface` from the allowlist (custom patch required).
- Restrict control panel access to trusted users only, as the attack requires authenticated access.
- Monitor for unusual Twig template renders or unexpected
system()/exec()calls in your server logs.
Impact:
Remote Code Execution (RCE) – An authenticated attacker can execute arbitrary PHP code on the server, leading to complete compromise of the application, database, and underlying host. This includes data exfiltration, ransomware deployment, backdoor installation, and lateral movement within the network. The vulnerability bypasses the Twig sandbox—a key hardening control—rendering the `enableTwigSandbox()` setting ineffective. Given that the attack requires only basic control panel credentials, the risk is elevated for any Craft CMS installation with user-facing admin interfaces.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
