Craft hat einen Twig Function Blocklist Bypass

The impact of this RCE vulnerability is severe. An attacker who can successfully exploit it can gain complete control over the affected Craft CMS instance. This includes the ability to read, modify, and delete sensitive data, install malicious software, and potentially pivot to other systems on the network. The ability to execute arbitrary PHP code bypasses standard security controls, making it a highly dangerous vulnerability. The requirement for admin access or allowAdminChanges does limit the immediate attack surface, but compromise of an admin account would grant the attacker full control.

Organizations using Craft CMS versions 4.0.0-RC1 through 5.9.0-beta.1 are at risk, particularly those with allowAdminChanges enabled on production servers or with compromised administrator accounts. Shared hosting environments running Craft CMS are also at increased risk due to the potential for cross-site contamination.

• php / server:

find /var/www/craftcms -name '*.twig' -print0 | xargs -0 grep -iE '(?<=->)\s*\(array_map|array_walk|call_user_func|call_user_func_array|create_function|eval|exec|passthru|shell_exec|system|proc_open|proc_close|proc_get_status|phpinfo|assert|unlink|rmdir|rename|copy|move|file_put_contents|file_get_contents|include|require|include_once|require_once|session_start|session_destroy|$_GET|$_POST|$_REQUEST|$_COOKIE|$_SESSION|$_ENV|$_SERVER|$_FILES'

• php / server:

ps aux | grep -i craftcms | grep -i 'twig->renderTemplate' | grep -i 'allowAdminChanges=1'

1. 2026-03-04Disclosure

   disclosure

1. Reserviert2026-03-03
2. Veröffentlicht2026-03-04
3. Geändert2026-03-06
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to Craft CMS version 5.9.0-beta.1 or later, which includes the necessary fixes to the blocklist. If upgrading immediately is not possible, disabling the allowAdminChanges setting on production environments can significantly reduce the attack surface. Carefully review and restrict user permissions to limit the number of accounts with administrative privileges. Consider implementing a Web Application Firewall (WAF) with rules to detect and block attempts to execute arbitrary PHP code through Twig templates, although this is not a substitute for patching. Monitor system logs for unusual PHP activity or attempts to access sensitive files.