Advisory · CVE-2026-112773
Craft CMS element criteria injection lets authenticated panel users escape the Twig sandbox
Craft CMS 5.0.0 before 5.11.0 passes uncleansed criteria from getNext, getPrev, and getOwners into Craft::configure, so authenticated Control Panel users can inject Yii as or on keys and execute code as the web user when the element query runs. CVSS 3.1 8.8.
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-112773
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Three helper methods hand your criteria straight to the configurator, so two magic keys ride along and become code that runs when the query executes.
- 01Panel access held
An authenticated Control Panel user reaches a sandboxed template calling getNext, getPrev, or getOwners, with the Twig sandbox enabled.
- 02Criteria keys supplied
The attacker includes as or on keys in the criteria array.
- 03Configuration uncleansed
The criteria pass to Craft::configure without cleansing, attaching a behavior or event handler to the element query.
- 04Query fires handler
When the query executes, the injected handler runs, giving code execution as the web user.
What happened
Craft CMS disclosed CVE-2026-112773 (CWE-94) for versions 5.0.0 before 5.11.0: the sandboxed element methods getNext, getPrev, and getOwners accept a criteria array and pass it uncleansed to Craft::configure, which honours Yii as and on keys, attaching attacker-controlled behaviors or event handlers that fire when the element query runs.
The vendor advisory states the reachability gate plainly: the Twig sandbox must be enabled (enableTwigSandbox, off by default) and the attacker needs authenticated Control Panel access, including lower-privilege panel editors through element-select condition rules. Per the vendor affected data, 5.11.0 is the first unaffected release.
What to do
- Inventory Craft CMS sites and note whether each runs the 4.x or 5.x line.
- Upgrade affected sites to 5.11.0 or later using the project release guidance.
- Restrict Control Panel access to trusted networks and named administrators while remediation is underway.
- Hunt for templates or condition rules calling getNext, getPrev, or getOwners with as or on keys in their criteria.
- Verify the deployed version after updating, not just that an update ran.
Management note
Same family, third sink in one release. If your Craft sites enable the Twig sandbox for anything less trusted than full administrators, treat the whole 5.11.0 upgrade as a single urgent change.