CVE-2026-105985

8.8 HIGHpublic exploit available

Published 2026-10-06 · Updated 2026-10-07

AI risk analysis

Summary: The flaw allows authenticated users to execute arbitrary code via the Control Panel, posing a significant security risk.
Exploitability: Exploitation is relatively straightforward for any authenticated user with basic Control Panel access, requiring no additional permissions.
Blast radius: If exploited, this vulnerability could lead to complete compromise of the system, including execution of arbitrary commands with PHP/web-server privileges.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Craft CMS 5.10.13.3 or later.

rceauth-bypassweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate(). This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process. The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-1336

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.