craftcms/cms: Twig sandbox allowlist bypass discloses sensitive values

Six sandbox-allowlisted Twig filters — column, contains, filterByValue, index, where, multisort — are registered without the needs_is_sandboxed flag (unlike map/filter/sort/reduce, which have it). Each resolves a caller-supplied string key via ArrayHelper::getValue(), which performs a raw $obj->$key property/getter dispatch (triggering Yii __get) with dot-path graph traversal, never consulting the sandbox SecurityPolicy. This lets a sandboxed template read non-allowlisted getters and traverse the always-present craft global to disclose securityKey, database credentials, and auth tokens.

Reachability gate (identical to published advisory GHSA-f5wm-88jv-g5hx): enableTwigSandbox=true (default false) plus authenticated Control Panel access. B2 element-select condition rules need no element in scope.

Impact

Sandbox allowlist bypass yielding disclosure of securityKey (GeneralConfig.php public property — underpins CSRF tokens, cookie signing, and data encryption), database credentials, session/request data, and auth-cookie tokens. Read-only: getValue invokes a key as a callable only when it is a real \Closure, which a Twig template cannot construct — so this is an arbitrary property/no-arg-getter READ and dot-path traversal, not an RCE.

Report ID: 1719