CVE-2026-124430
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker.