CERT24CVE-2026-115938 — Low-privilege condition filter escapes the Twig sandbox, recovers “securityKey” and reaches RCELoading data…
CERT24Threat Observatory
Period

CVE-2026-115938 — Low-privilege condition filter escapes the Twig sandbox, recovers “securityKey” and reaches RCE

In Craft CMS, any authenticated control-panel user can submit an element-search condition whose selector is evaluated as a sandboxed Twig template. The condition-processing path can bypass the sandbox, recover GeneralConfig::securityKey, and reach unsandboxed template processing through signed parameters.

← Back to intelligence

CVE-2026-115938 — Low-privilege condition filter escapes the Twig sandbox, recovers “securityKey” and reaches RCE

In Craft CMS, any authenticated control-panel user can submit an element-search condition whose selector is evaluated as a sandboxed Twig template. The condition-processing path can bypass the sandbox, recover GeneralConfig::securityKey, and reach unsandboxed template processing through signed parameters.