High · published January 6, 2026
⚠️ If you're using Craft CMS, your admin dashboard might be a bit too friendly! An authenticated Remote Code Execution (RCE) vulnerability lurking in versions 5.0.0-RC1 to 5.8.20 and 4.0.0-RC1 to 4.16.16 could let an attacker run wild. 🔥 Think of this vulnerability like a venue with a VIP lounge that allows users to rearrange the furniture and change the decor. If a rogue admin or an ordinary user with sneaky access slips in, they could turn the whole place upside down! An attacker with admin access could execute malicious commands, compromising your entire system. This may lead to unauthorized data manipulation, deletion, or worse, entrusting your site to the whims of a digital vandal. Protecting your Craft environment is crucial!
Think of this vulnerability like a venue with a VIP lounge that allows users to rearrange the furniture and change the decor. If a rogue admin or an ordinary user with sneaky access slips in, they could turn the whole place upside down! This vulnerability arises from a flaw in Twig's Server-Side Template Injection (SSTI) mechanism, allowing crafted payloads via text fields that process Twig input. By exploiting this, attackers can execute arbitrary code if they can access the necessary tools in the Craft Control Panel.
An attacker with admin access could execute malicious commands, compromising your entire system. This may lead to unauthorized data manipulation, deletion, or worse, entrusting your site to the whims of a digital vandal. Protecting your Craft environment is crucial! Update immediately to versions 5.8.21 and 4.16.17 to seal this security hole. If you're running older versions, ensure that allowAdminChanges is turned off for non-dev environments and audit your current user roles. You've got this! With a quick update and a few settings adjustments, you'll be back on track in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| craftcms/craft_cms | ≥ 4.0.0.1, < 4.16.17 | 4.16.17 |
| craftcms/craft_cms | ≥ 5.0.1, < 5.8.21 | 5.8.21 |
| craftcms/craft_cms | all versions | — |
| craftcms/craft_cms | all versions | — |
| craftcms/craft_cms | all versions | — |
| craftcms/craft_cms | all versions | — |
| craftcms/craft_cms | all versions | — |
| craftcms/craft_cms | all versions | — |