{"schema":"threatline.record/2","record":{"id":"GHSA-v4q3-2g5g-wjj6","aliases":["GHSA-v4q3-2g5g-wjj6"],"summary":"Low privilege condition filter escapes Twig sandbox, recovers \"securityKey\" and reaches RCE","details":"Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed `column` filter delegates property lookup to Yii `ArrayHelper`, outside Twig’s `SecurityPolicy`. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.\r\n\r\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID `1` when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\r\n\r\nAfter recovering `GeneralConfig::securityKey`, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as `redirect` are then accepted and passed to unsandboxed `View::renderObjectTemplate()`, where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless `substr()` callback and observes `abcdef` becoming `cdef`; it does not execute an OS command.\r\n\r\n### Impact\r\n\r\n* Successful exploitation escapes the intended template security authority and executes attacker-selected PHP callables as the web server user.\r\n\r\nReport ID: 1887","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6","source_modified_at":"2026-10-23T08:53:55Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 4.0.0, < 4.18.9"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6","source_modified_at":"2026-10-23T08:53:55Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, < 5.11.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6","source_modified_at":"2026-10-23T08:53:55Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"4.18.9"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6","source_modified_at":"2026-10-23T08:53:55Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.2"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T08:53:55Z","modified_at":"2026-10-23T08:53:55Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6","fetched_at":"2026-10-25T18:55:31.805249Z","source_modified_at":"2026-10-23T08:53:55Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T08:53:55Z","content_hash":"fdfe1303ae28aef60636802ce16f96b7fa7a30793ec6afd3ec1fe083b627915c"}}