Craft CMS Remote Code Execution Vulnerability via Twig Server-Side Template Injection

A remote code execution vulnerability has been identified in Craft CMS versions 4.0.0-RC1 prior to 4.16.5 and 5.0.0-RC1 prior to 5.8.6. This vulnerability arises from server-side template injection (SSTI) in Twig, allowing for potential code execution. The issue requires administrator access and the 'ALLOW_ADMIN_CHANGES' setting to be enabled.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Craft CMS is hosted.

Reproduction

To reproduce this vulnerability, an administrator must upload a Twig template that includes a payload capable of executing PHP code. This can be done through the admin panel, where template files can be edited or uploaded. Once the template is saved, the injected code will be executed on the server.

Remediation

Users should update Craft CMS to version 4.16.6 or 5.8.7, where this vulnerability has been patched.