{"schema":"threatline.record/2","record":{"id":"GHSA-g48f-wc2q-4rrv","aliases":["GHSA-g48f-wc2q-4rrv"],"summary":"Authenticated RCE via render-components Entry Type overrides","details":"Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action `app/render-components`.\r\n\r\nAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an `EntryType` object’s `uiLabelFormat` and then rendering an `Entry` that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by `renderObjectTemplate()`.\r\n\r\nThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as `system()`, resulting in operating-system command execution with the privileges of the PHP/web-server process.\r\n\r\nThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.\r\n\r\n### Prerequisites\r\n\r\n1. Give the user Control Panel access.\r\n2. Ensure at least one entry type and one entry exist. They do not need to correspond because `typeId` is overridden in memory.\r\n3. Sign in as the limited user and record:\r\n   - the authenticated session/Cookie header;\r\n   - the raw `csrfTokenValue` returned by Craft for that session;\r\n   - the numeric ID of an existing entry type;\r\n   - the numeric element ID of an existing entry.\r\n\r\n## Impact\r\nThis is an authenticated OS command execution vulnerability. A malicious or compromised low-privileged Control Panel account can cross from application-level access to code execution as the PHP/web-server service account.\r\n\r\nDepending on that operating-system account’s permissions, exploitation may allow the attacker to:\r\n\r\n- read Craft security keys, database credentials, and environment configuration available to PHP;\r\n- read or modify site content and user data;\r\n- modify application files writable by the web-server account and establish persistence;\r\n- access internal services reachable from the Craft host; or\r\n- disrupt availability.\r\n\r\nThe exploit does not require `allowAdminChanges`, project-config modification, Kubernetes object access, environment-variable control, prior filesystem access, root privileges, poison injection from another system, or exploitation of an upstream dependency vulnerability.\r\n\r\nReport ID: 1684","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv","source_modified_at":"2026-10-05T17:33:37Z","fetched_at":"2026-10-23T20:39:26.410340Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, < 5.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv","source_modified_at":"2026-10-05T17:33:37Z","fetched_at":"2026-10-23T20:39:26.410340Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.0"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:33:37Z","modified_at":"2026-10-05T17:33:37Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv","fetched_at":"2026-10-23T20:39:26.410340Z","source_modified_at":"2026-10-05T17:33:37Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T17:33:37Z","content_hash":"f5bcf27abc28d8c946e383162755dd809644b39b6f1604903e559af5793a1260"}}