CVE-2026-72781
A permanent, source-backed tracker page. Values are shown only when returned; explicit gaps and read failures remain different states.
What it is
ReportedCraft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via en… Source description excerpt; complete tracked detail loads below.
Evidence: Source reported · Source: CVE record · Source last published: 2026-08-11 12:17 UTC · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
What is affected
Reportedcraftcms — cms. Product-level identification only; no affected-version conclusion is available from this field.
Evidence: Source reported · Source: CVE record · Source last published: 2026-08-11 12:17 UTC · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
Urgency and basis
ReportedTrack* · 215.9
Evidence: Tracker computed · Tracker decision tier from the evidence detailed below · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
Exploitation evidence
Not reportedNot reported by tracked sources.
What to do
ReportedA source remediation link is available. Validate that guidance against the affected product and your environment.
Source remediation ↗Evidence: Source reported · Tracked source remediation field · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
Evidence detail
Loading the full tracker evidence record…