CVE-2026-79988

Description

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

References

• https://github.com/craftcms/cms
• https://github.com/craftcms/cms/releases/tag/5.10.7
• https://www.hckrt.com/hacktivity/HCKRT-8RQQ7K