CVE-2026-79988CWE-693

CVE-2026-79988

published August 27, 2026

CVSS

8.7

EPSS

Percentile

38.2

In the wild

Unconfirmed

What it is

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

The record

Technical detail

CVSS: 8.7 · NONE
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00451 · 38.2th percentile
Weakness: CWE-693 · Protection Mechanism Failure
Published: 2026-08-27T21:20Z

References (3)

https://github.com/craftcms/cms · 7004884b-51e2-48e8-b4a2-5ca29e80453e https://github.com/craftcms/cms/releases/tag/5.10.7 · 7004884b-51e2-48e8-b4a2-5ca29e80453e https://www.hckrt.com/hacktivity/HCKRT-8RQQ7K · 7004884b-51e2-48e8-b4a2-5ca29e80453e

EPSS history

Timeline

27 AUG 15:36Z
Authenticated RCE through Twig sandbox escape
cvelistv5