CVE-2026-79988 — Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulne…
Published: 2026-08-27 · CVSS: 8.7 · CVSS 4.0
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7