All vulnerabilities
GHSA-qm9x-rmcj-h2rc

craftcms/cms: Authenticated RCE: Twig sandbox "on/as" behavior injection via "Asset::getMimeType" transform

craftcms/cms
Open in ThreatlineRecord JSON
CVSS
n/aHigh
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in5.11.0Fixed versionGitHub
Published5 Oct 2026Updated 5 Oct 2026GitHub

What fixes it

  • 5.11.0craftcms/cms, composerGitHubcomposer require "craftcms/cms:^5.11.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The #[AllowedInSandbox] method Asset::getMimeType(mixed $transform = null) passes a caller-supplied transform array to ImageTransforms::normalizeTransform(), which — after rejecting only the class key — calls Craft::createObject(['class'=>ImageTransform::class, ...$transform]) with no cleanse. Surviving as X / on X keys are honored during ImageTransform (a craft\base\Model) construction, attaching an attacker-controlled behavior/event handler and firing EVENT_INIT, yielding authenticated remote code execution.

Reachability gate (identical to published advisory GHSA-f5wm-88jv-g5hx): enableTwigSandbox=true (default false) plus authenticated Control Panel access, via the B1/B2 sandbox-render entry points (Mailer.php:181-183, BaseElementSelectConditionRule.php:130).

Impact

Authenticated (Control Panel user) remote code execution as the web user via Yii behavior/event injection through a distinct sink (Craft::createObject).

Report ID: 1718

Text from GitHub Advisory Database

Affected versions 1

  • craftcms/cms, composer>= 5.0.0, <= 5.11.0GitHub