Listen to this Post
This vulnerability, tracked in the GitHub Advisory Database, enables authenticated Remote Code Execution (RCE) in Craft CMS via Server-Side Template Injection (SSTI) in the Twig templating engine. The exploit requires an attacker to have administrator-level access to the Craft Control Panel with the `allowAdminChanges` configuration setting enabled, which is not recommended for production. Alternatively, a non-administrator account with access to the System Messages utility can be used if `allowAdminChanges` is disabled. The vulnerability resides in text fields that accept Twig syntax within the Settings panel or the System Messages utility. By injecting a malicious payload utilizing the Twig `map` filter, an attacker can break out of the template sandbox and execute arbitrary PHP code on the underlying server. This occurs because the filter can be abused to call system-level functions, leading to a full chain from template injection to code execution. The vulnerability affects multiple versions of Craft CMS 4.x and 5.x where the Twig environment is improperly sanitized for these specific administrative inputs.
Platform: Craft CMS
Version: 4.0.0 – 5.8.20
Vulnerability: Authenticated RCE
Severity: Moderate
date: 2026-01-03
Prediction: Patched 2025-12-04
What Undercode Say:
curl -s https://api.github.com/repos/craftcms/cms/git/commits/d82680f
{{ ['id']|map((arg)=>system(arg)) }}
{{ ['cat /etc/passwd']|map((arg)=>system(arg)) }}
How Exploit:
1. Acquire admin credentials.
2. Navigate to System Messages.
3. Inject Twig `map` filter payload.
4. Trigger message rendering for RCE.
Protection from this CVE
Update to versions 5.8.21 or 4.16.17. Set `allowAdminChanges` to `false` in production environments as per Craft CMS hardening guidelines.
Impact:
Remote Code Execution leading to complete server compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
