craftcms/cms: Authenticated RCE: Twig sandbox "on/as" behavior injection via uncleansed "getNext/getPrev/getOwners" criteria

Two #[AllowedInSandbox] element methods — ElementInterface::getNext()/getPrev() and NestedElementInterface::getOwners() — accept an arbitrary criteria array from inside a Twig sandbox and pass it, uncleansed, to Craft::configure(). Yii's configure() honors the special as X / on X config keys, attaching an attacker-controlled behavior or event handler to the element query. When the query executes (->ids()), EVENT_BEFORE_PREPARE fires, and the injected handler runs, resulting in authenticated remote code execution as the web user.

Reachability gate (identical to published advisory GHSA-f5wm-88jv-g5hx: enableTwigSandbox=true (default false, GeneralConfig.php:1278) plus authenticated Control Panel access. Sandbox-render entry points: B1 system messages (Mailer.php:181-183, renderSandboxedString, e.g., forgot-password with a User element in scope) and B2 element-select condition rules (BaseElementSelectConditionRule.php:130, renderSandboxedObjectTemplate, reachable by lower-privilege CP editors).

Impact

Authenticated (Control Panel user) remote code execution as the web user via Yii behavior/event injection — the same terminal gadget class the vendor treated as RCE in GHSA-qrgm-p9w5-rrfw / CVE-2026-44011, GHSA-265m-7826-wjqm, and the original issue advisory.

Report ID: 1717