{"schema":"threatline.record/2","record":{"id":"GHSA-qm9x-rmcj-h2rc","aliases":["GHSA-qm9x-rmcj-h2rc"],"summary":"Authenticated RCE: Twig sandbox \"on/as\" behavior injection via \"Asset::getMimeType\" transform","details":"The `#[AllowedInSandbox]` method `Asset::getMimeType(mixed $transform = null)` passes a caller-supplied transform array to `ImageTransforms::normalizeTransform()`, which — after rejecting only the `class` key — calls `Craft::createObject(['class'=>ImageTransform::class, ...$transform])` with no cleanse. Surviving `as X` / `on X` keys are honored during `ImageTransform` (a `craft\\base\\Model`) construction, attaching an attacker-controlled behavior/event handler and firing `EVENT_INIT`, yielding authenticated remote code execution.\r\n\r\nReachability gate (identical to published advisory GHSA-f5wm-88jv-g5hx): `enableTwigSandbox=true` (default false) plus authenticated Control Panel access, via the B1/B2 sandbox-render entry points (`Mailer.php:181-183`, `BaseElementSelectConditionRule.php:130`).\r\n\r\n### Impact\r\nAuthenticated (Control Panel user) remote code execution as the web user via Yii behavior/event injection through a distinct sink (`Craft::createObject`).\r\n\r\nReport ID: 1718","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-qm9x-rmcj-h2rc","source_modified_at":"2026-10-05T17:48:02Z","fetched_at":"2026-10-23T21:14:28.314422Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, <= 5.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-qm9x-rmcj-h2rc","source_modified_at":"2026-10-05T17:48:02Z","fetched_at":"2026-10-23T21:14:28.314422Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.0"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:48:02Z","modified_at":"2026-10-05T17:48:02Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-qm9x-rmcj-h2rc","fetched_at":"2026-10-23T21:14:28.314422Z","source_modified_at":"2026-10-05T17:48:02Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T17:48:02Z","content_hash":"0f6d33342dc79d1361f2fd40fd3056bb65bca9f4eb18bb0a5a944992fd3eb6c2"}}