TI-2026-68405 Aliases CVE-2026-105985 GHSA-x658-h3pq-chcg

Remote code execution in Craft CMS via render-components action

MEDIUM 41CWE-1336Published 2026-10-06 · Updated 2026-10-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1336.

Summary

Craft CMS from 5.0.0 before 5.11.0 contains a template injection flaw (CWE-1336) in the render-components Control Panel action. Request-supplied Twig is evaluated without a sandbox, so any authenticated user with basic Control Panel access can run operating system commands with the privileges of the PHP web server process.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate(). This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process. The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00688 52nd percentileScored 2026-11-07

Fix Fixed cms (craftcms): 5.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Craft CMS	cms	5.0.0 to before 5.11.0	5.11.0	Patch available	CNA

cms VendorCraft CMS Affected 5.0.0 to before 5.11.0 Fixed in 5.11.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:craftcms:craft_cms::::::::	—	—	Craft CMS

cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* Versions — — ·Craft CMS

Remediation

Upgrade Craft CMS to version 5.11.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA cms (craftcms) Fixed in 5.11.0

Timeline

2026-10-06 Threatist record created from CVE-2026-105985
2026-10-06 Alias added: GHSA-x658-h3pq-chcg
2026-10-07 CISA SSVC decision points changed
2026-10-07 Priority changed: LOW → MEDIUM

References

Advisory 2

Other 2

TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
TI-2023-22284 Craft CMS Remote Code Execution vulnerability CVSS 3.1CRITICAL 10.0
TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8

See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences