CVE-2026-112773

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112773

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112773.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112773

Aliases

GHSA-wr79-9v6x-5rfq

Published

2026-10-19T19:10:51Z

Modified

2026-10-20T11:18:23Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Details

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112773.json"
}

References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type

GIT

Repo

https://github.com/craftcms/cms

Events

Introduced

f6a8fb685d44e387435825e3a96809eeda4973a6

Fixed

2255717bfd5cc502751601aa68bf72eea035cd47

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "5.0.0"
        },
        {
            "fixed":  "5.11.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112773.json"