CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109305
HIGHCVSS 8.8NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to e
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-65197 LOW 3.1
- CVE-2026-53418 HIGH 8.1
- CVE-2026-109521 HIGH 7.3
- CVE-2026-109522 HIGH 7.3
- CVE-2026-109523 HIGH 7.3
- CVE-2026-108184 HIGH 7.4
- CVE-2026-106108
- CVE-2026-107460
- CVE-2026-102342 MEDIUM 5.4
- CVE-2026-74036 HIGH 7.2