---
id: CVE-2026-112773
title: Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
summary: >-
  Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution
  vulnerability that allows authenticated Control Panel users to escape the Twig
  sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners.
  Attackers can in…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
vendor: craftcms
product: cms
affected:
  - cms >= 5.0.0 < 5.11.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-19T21:23:21.926880Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T21:23:32.874Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112773'
references:
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-wr79-9v6x-5rfq'
    label: GitHub Security Advisory (GHSA-wr79-9v6x-5rfq)
  - url: >-
      https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.0-rce-via-twig-sandbox-behavior-injection
    label: >-
      VulnCheck Advisory: Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox
      Behavior Injection
tags:
  - cve.org
ingestedAt: '2026-10-19T19:38:06.466Z'
---

## Overview

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.

## Affected

- `cms >= 5.0.0 < 5.11.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.