Vulnerability · Published Oct 6, 2026 · Assigned by Hackrate
CVE-2026-105985Authenticated RCE via render-components Entry Type overrides
High 8.8
In plain English
A high-severity security flaw in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate(). This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process. The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.
Affected products (as reported)
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.hckrt.com/hacktivity/HCKRT-PVWH7W third-party-advisory, technical-description, mitigation
- https://github.com/craftcms/cms/releases/tag/5.11.0 release-notes
- https://github.com/craftcms/cms product
- https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv third-party-advisory