Description
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 5.10.2 – < 5.10.14 | 5.10.14 |
References
- GitHub Security Advisory (GHSA-vfcw-xv8p-8rj2) vendor-advisory
- VulnCheck Advisory: Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every third-party-advisory