{"schema":"threatline.record/2","record":{"id":"GHSA-wr79-9v6x-5rfq","aliases":["GHSA-wr79-9v6x-5rfq"],"summary":"Authenticated RCE: Twig sandbox \"on/as\" behavior injection via uncleansed \"getNext/getPrev/getOwners\" criteria","details":"Two `#[AllowedInSandbox]` element methods — `ElementInterface::getNext()/getPrev()` and `NestedElementInterface::getOwners()` — accept an arbitrary criteria array from inside a Twig sandbox and pass it, uncleansed, to `Craft::configure()`. Yii's `configure()` honors the special `as X` / `on X` config keys, attaching an attacker-controlled behavior or event handler to the element query. When the query executes (`->ids()`), `EVENT_BEFORE_PREPARE` fires, and the injected handler runs, resulting in authenticated remote code execution as the web user.\r\n\r\nReachability gate (identical to published advisory GHSA-f5wm-88jv-g5hx: `enableTwigSandbox=true` (default false, `GeneralConfig.php:1278`) plus authenticated Control Panel access. Sandbox-render entry points: B1 system messages (`Mailer.php:181-183`, `renderSandboxedString`, e.g., forgot-password with a User element in scope) and B2 element-select condition rules (`BaseElementSelectConditionRule.php:130`, `renderSandboxedObjectTemplate`, reachable by lower-privilege CP editors).\r\n\r\n## Impact\r\n\r\nAuthenticated (Control Panel user) remote code execution as the web user via Yii behavior/event injection — the same terminal gadget class the vendor treated as RCE in GHSA-qrgm-p9w5-rrfw / CVE-2026-44011, GHSA-265m-7826-wjqm, and the original issue advisory.\r\n\r\nReport ID: 1717","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-wr79-9v6x-5rfq","source_modified_at":"2026-10-05T17:45:59Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, <= 5.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-wr79-9v6x-5rfq","source_modified_at":"2026-10-05T17:45:59Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.0"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:45:59Z","modified_at":"2026-10-05T17:45:59Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-wr79-9v6x-5rfq","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-05T17:45:59Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T17:45:59Z","content_hash":"c32d534c157234ef8c74bcc69038504bf1d196d51f38396f1e4c40aa2d1a86f9"}}