High priorityDisclosed

Advisory · CVE-2026-109305

Craft CMS Twig sandbox bypass allows code execution

Non-admin Craft CMS users with the System Messages permission can escape the Twig sandbox through the has some and has every operators, invoking PHP callables to execute code as the web server user. Fixed in Craft CMS 5.10.14.

Advisory published October 12, 2026Independent summary
Vendor
Craft CMS
Product
Craft CMS
Identifier / CWE
CVE-2026-109305
CWE-1336
Action timing
Immediate
ELI5

Explain it like I’m five

Editors are allowed to arrange furniture in a locked room using only safe tools. Two of the safe tools turn out to be levers that open the toolbox, so an editor can grab the power tools and run them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Low-privilege account

    An attacker signs in as a non-admin user who holds the System Messages permission.

  2. 02Template supplied

    The attacker writes a sandboxed Twig template that uses the has some or has every operator with a two-argument callable.

  3. 03Sandbox escaped

    The operators invoke PHP callables such as passthru or system that the sandbox was meant to block.

  4. 04Code executes

    The callable runs with the permissions of the web server user.

What happened

The Craft CMS security advisory for CVE-2026-109305 covers Craft CMS from 5.10.2 before 5.10.14 and rates the flaw CVSS 3.1 8.8.

Craft’s Twig sandbox is meant to stop templates from calling arbitrary PHP. The has some and has every operators accept two-argument callables, and a non-admin user with the System Messages permission can supply callables such as passthru or system in a sandboxed template. That invokes the callable and executes code as the web server user, bypassing the sandbox.

Per the advisory record, versions before 5.10.14 in the affected range are vulnerable and 5.10.14 is the fixed release.

What to do

  1. Inventory Craft CMS sites and check each site’s version.
  2. Upgrade affected sites to Craft CMS 5.10.14 or later.
  3. Review which non-admin accounts hold the System Messages permission and trim it where it is not needed.
  4. Review logs and template-related content for unexpected callables or shell commands.
  5. Check the server for new files, processes, or outbound connections that a web-shell would leave behind.
  6. Confirm the deployed version after upgrading.

Management note

This turns a routine editorial permission into server code execution. Sites that delegate system messages to marketing or agency users should patch first and re-check who really needs that permission second.