CVE-2026-79988

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-79988

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79988.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-79988

Published

2026-08-27T15:36:18Z

Modified

2026-08-30T03:30:59Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Authenticated RCE through Twig sandbox escape

Details

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

Database specific

{
    "cna_assigner": "Hackrate",
    "cwe_ids": [
        "CWE-693"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79988.json"
}

References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type

GIT

Repo

https://github.com/craftcms/cms

Events

Introduced

daac7c1da2f701f2e9ddee1da1457ce61660b581

Introduced

04755d93f86d07cc183db47db8a0eee106892e30

Fixed

a65e9f5b33801cd89d859cee78573fd04df1ed57

Fixed

6a08356668f772f0a4d79769d3de83508cd4e21c

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "4.0.0-RC1"
        },
        {
            "fixed": "4.18.3"
        },
        {
            "introduced": "5.0.0-RC1"
        },
        {
            "fixed": "5.10.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79988.json"