{"schema":"threatline.record/2","record":{"id":"CVE-2026-105985","aliases":["GHSA-g48f-wc2q-4rrv"],"summary":"Authenticated RCE via render-components Entry Type overrides","details":"Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.\n\n\n\nAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().\n\n\n\nThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.\n\n\n\nThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.","categories":["Unclassified"],"product":"cms","vendor":"craftcms","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105985","source_modified_at":"2026-10-07T03:55:21.500Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"cms","vendor":"craftcms","versions":[{"status":"affected","version":"5.0.0","lessThan":"5.11.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105985","source_modified_at":"2026-10-07T03:55:21.500Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"cms","ecosystem":null},"version":"5.11.0","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00688,"percentile":0.52165,"score_date":"2026-10-23"},"published_at":"2026-10-06T10:23:25.037Z","modified_at":"2026-10-07T03:55:21.500Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105985","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-07T03:55:21.500Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105985","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.hckrt.com/hacktivity/HCKRT-PVWH7W","tags":["third-party-advisory","technical-description","mitigation"]},{"source":"CVE List","url":"https://github.com/craftcms/cms/releases/tag/5.11.0","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/craftcms/cms","tags":["product"]},{"source":"CVE List","url":"https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-06T00:00:00+00:00"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T03:55:21.500Z","content_hash":"3e6ce667f5b2e4b317a8726e3fcf57d013f5015efdc394b11e1d69d07dd7b03b"}}