{"schema":"threatline.record/2","record":{"id":"GHSA-xmwr-88vw-5ghh","aliases":["GHSA-xmwr-88vw-5ghh"],"summary":"Authenticated RCE via Twig group filter array-callable","details":"The Twig `group` filter’s arrow argument is invoked without the `checkArrow` guard that every other arrow-accepting filter has. `groupFilter(iterable $arr, callable|string $arrow)` takes the non-string branch `$groupKey = (string)$arrow($item, $key)` for any non-string `$arrow`. A Twig array literal such as `['craft\\helpers\\FileHelper','writeToFile']` is a valid PHP array-callable, is not a string, and is invoked with two attacker-controlled arguments — arbitrary static/instance method invocation. When combined with `FileHelper::writeToFile`, this writes an attacker-controlled webshell to the webroot, an authenticated RCE requiring no gadget.\r\n\r\nReachability gate (identical to published advisory GHSA-f5wm-88jv-g5hx): `enableTwigSandbox=true` (default false) plus authenticated Control Panel access, via B2 element-select condition rules (`BaseElementSelectConditionRule.php:130`, reachable by lower-privilege control panel editors).\r\n\r\n## Impact\r\n\r\nAn authenticated control panel user can achieve a remote code execution as the web user, no gadget required.\r\n\r\nReport ID: 1720","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-xmwr-88vw-5ghh","source_modified_at":"2026-10-05T17:51:53Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 4.0.0, <= 4.18.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-xmwr-88vw-5ghh","source_modified_at":"2026-10-05T17:51:53Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, < 5.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-xmwr-88vw-5ghh","source_modified_at":"2026-10-05T17:51:53Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"4.18.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-xmwr-88vw-5ghh","source_modified_at":"2026-10-05T17:51:53Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.0"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:51:53Z","modified_at":"2026-10-05T17:51:53Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-xmwr-88vw-5ghh","fetched_at":"2026-10-23T19:00:29.328130Z","source_modified_at":"2026-10-05T17:51:53Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T17:51:53Z","content_hash":"f63ec085a6a4ef122f00f5991be9d7e2fe143e3457c1ce551e70529fa050bf05"}}