{"schema":"threatline.record/2","record":{"id":"GHSA-j697-8x93-7mp2","aliases":["GHSA-j697-8x93-7mp2"],"summary":"Twig sandbox allowlist bypass discloses sensitive values","details":"Six sandbox-allowlisted Twig filters — `column`, `contains`, `filterByValue`, `index`, `where`, `multisort` — are registered without the `needs_is_sandboxed` flag (unlike `map`/`filter`/`sort`/`reduce`, which have it). Each resolves a caller-supplied string key via `ArrayHelper::getValue()`, which performs a raw `$obj->$key` property/getter dispatch (triggering Yii `__get`) with dot-path graph traversal, never consulting the sandbox `SecurityPolicy`. This lets a sandboxed template read non-allowlisted getters and traverse the always-present `craft` global to disclose `securityKey`, database credentials, and auth tokens.\r\n\r\nReachability gate (identical to published advisory GHSA-f5wm-88jv-g5hx): `enableTwigSandbox=true` (default false) plus authenticated Control Panel access. B2 element-select condition rules need no element in scope.\r\n\r\n### Impact\r\n\r\nSandbox allowlist bypass yielding disclosure of `securityKey` (`GeneralConfig.php` public property — underpins CSRF tokens, cookie signing, and data encryption), database credentials, session/request data, and auth-cookie tokens. Read-only: `getValue` invokes a key as a callable only when it is a real `\\Closure`, which a Twig template cannot construct — so this is an arbitrary property/no-arg-getter READ and dot-path traversal, not an RCE.\r\n\r\nReport ID: 1719","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-j697-8x93-7mp2","source_modified_at":"2026-10-05T17:49:09Z","fetched_at":"2026-10-25T11:14:20.449793Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 4.0.0, < 4.18.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-j697-8x93-7mp2","source_modified_at":"2026-10-05T17:49:09Z","fetched_at":"2026-10-25T11:14:20.449793Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, < 5.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-j697-8x93-7mp2","source_modified_at":"2026-10-05T17:49:09Z","fetched_at":"2026-10-25T11:14:20.449793Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"4.18.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-j697-8x93-7mp2","source_modified_at":"2026-10-05T17:49:09Z","fetched_at":"2026-10-25T11:14:20.449793Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.0"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:49:09Z","modified_at":"2026-10-05T17:49:09Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-j697-8x93-7mp2","fetched_at":"2026-10-25T11:14:20.449793Z","source_modified_at":"2026-10-05T17:49:09Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T17:49:09Z","content_hash":"a7bb718211c9a1c98cffb1d69ef879cb62b4a2ca1e4157f2607ed760f836fe4e"}}