Craft CMS Remote Code Execution Vulnerability via Twig Template Injection

A remote code execution vulnerability has been identified in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16. This vulnerability arises from authenticated remote code execution potential through Twig server-side template injection. Exploitation requires administrator access to the Craft Control Panel with the 'allowAdminChanges' setting enabled, contrary to recommended practices for non-development environments. Alternatively, a non-administrator account can be used if it has access to the System Messages utility, allowing the crafting of a malicious payload using the Twig 'map' filter in text fields that accept Twig input under Settings or through the System Messages utility.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where Craft CMS is hosted.

Remediation

Users are advised to update to Craft CMS versions 5.8.21 or 4.16.17, where this vulnerability has been patched.