CVE Catalog
CVE-2026-79988
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk0.26%
17th percentile - higher than 17% of all known CVEs
Summary
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.
Risk Assessment
An authenticated attacker can gain full control of the server, potentially leading to data theft, content modification, or complete application takeover.
Recommendation
Update Craft CMS to the latest version and review the Twig sandbox configuration to restrict access to dangerous Yii functions.
Original NVD description (English source)
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.