GHSA-fp5j-j7j4-mcxc
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | craftcms/cms | >= 5.0.0-RC1, < 5.9.9 | 5.9.9 |
| Packagist | craftcms/cms | >= 4.0.0-beta.1, < 4.17.4 | 4.17.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system.
The `BaseElementSelectConditionRule::getElementIds()` method passes user-controlled string input
through `renderObjectTemplate()` -- an unsandboxed Twig rendering function with escaping disabled.
Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full
RCE by sending a crafted condition rule via standard element listing endpoints.
This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and
bypasses all production hardening settings (allowAdminChanges: false, devMode: false,
enableTwigSandbox: true).
Users should update to the patched 5.99 release to mitigate the issue.
References
External links from the advisory. They lead to third-party sites.