Description
Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 5.10.0 – < 5.11.2 | 5.11.2 |
References
- GitHub Security Advisory (GHSA-qj3q-j7r4-428p) vendor-advisory
- VulnCheck Advisory: Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle third-party-advisory