Craft Cms 5.10.2 Before 5.10.14 Twig Sandbox Bypass Rce Via Has Some Has Every

Back www.vulncheck.com

Craft Cms 5.10.2 Before 5.10.14 Twig Sandbox Bypass Rce Via Has Some Has Every

www.vulncheck.com • October 13, 2026

Share: View original

VulnCheck Advisory: Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RCE Vulnerabilities in Craft CMS Versions 4.0.0 and 5.0.0 Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 are affected by remote code execution (RCE) vulnerabilities. The vulnerabilities arise from improper control of code generation, specifically via actionCacheUpdates behavior injection and a Twig sandbox bypass. These flaws could allow attackers to execute arbitrary code on affected systems. Users are urged to upgrade to the latest versions to mitigate these risks. The vulnerabilities have been assigned CVE identifiers, with the first article detailing the RCE via actionCacheUpdates and the second addressing the Twig sandbox bypass. As of now, there are no reports of in the wild, but the potential for exploitation remains high. Security teams should prioritize patching to protect their installations. 71

Extracted Entities

Attack Types (1)

Zero-day Exploit

Platforms (1)

Vulnerabilities (1)

Twig Sandbox Bypass