CVE-2026-72781 craftcms CVE debrief

Who should care

Defenders of Craft CMS installations should assess exposure and prioritize patching. This includes operators, administrators, and security teams responsible for maintaining Craft CMS deployments. They should verify exposure, apply patches, and monitor for suspicious activity to mitigate potential risks associated with this vulnerability. Additionally, they should restrict access to the control panel to reduce the attack surface and review compensating be

Why it matters

CVE-2026-72781 is a remote code execution vulnerability in Craft CMS that requires verification of exposure and prompt patching.

• Verify exposure of Craft CMS installations to remote code execution
• Apply patches to prevent exploitation
• Restrict access to the control panel to reduce attack surface
• Monitor for suspicious activity to detect potential exploitation

Technical summary

The vulnerability is located in the Twig sandbox mechanism of Craft CMS. An authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii base Component arbitrary function-call gadget to execute arbitrary code. This occurs because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute, and the sandbox allowlisting extends to the entire class hierarchy (craft base Component up to yii base Component). The vulnerability affects Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3

Defensive priority

Defenders should prioritize verifying exposure of Craft CMS installations and applying vendor patches.

Recommended defensive actions

• Verify exposure of Craft CMS installations
• Apply vendor patches
• Restrict access to the control panel
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor statements. Defenders should verify exposure of Craft CMS installations and review vendor guidance for patching. The vulnerability affects Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3, and an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii base Component arbitrary

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.