Craft CMS before 4.18.8 and 5.11.0 has authenticated RCE flaws
Original title: Craft CMS security advisory (AV26-1067)
Canada's Cyber Centre lists Twig sandbox bypasses and admin remote code execution and urges administrators to apply updates.
The Canadian Centre for Cyber Security issued AV26-1067 on October 20, 2026, for Craft CMS before 4.18.8 and before 5.11.0. The notice lists authenticated remote code execution through Twig sandbox behavior and an allowlist bypass that discloses sensitive values. One path requires an authenticated administrator via Content Block field-layout JSON. It urges updates and does not state exploitation or name CVE identifiers.
- One issue is authenticated RCE via the Twig group filter array-callable.
- Twig sandbox on/as injection is described via Asset::getMimeType transforms.
- Further injection uses uncleansed getNext, getPrev, and getOwners criteria.
- Admin RCE uses Content Block field-layout JSON-string cleansing.
- The notice is serial AV26-1067, citing status as of October 19, 2026.
Impact: authenticated remote code execution and sensitive value disclosure
| Product | Affected | Fixed in |
|---|---|---|
| Craft CMS | prior to 4.18.8 and prior to 5.11.0 | 4.18.8 and 5.11.0 |
- 1.Update Craft CMS to 4.18.8 or 5.11.0 or later.
- 2.Review the linked Craft CMS security advisories.
- Vendors
- Craft CMS
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1067 Date: October 20, 2026 As of October 19, 2026, Craft CMS is affected by vulnerabilities in the following product: Craft CMS Prior to 4. 18. 8 Prior to 5.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.