{"id":"CVE-2026-105985","revision":"bd6968f5625e45f2b561f6e209ca6564","records":[{"revision":"bd6968f5625e45f2b561f6e209ca6564","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-105985","aliases":[],"title":"Authenticated RCE via render-components Entry Type overrides","description":"Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action\u00A0app/render-components.\n\n\n\nAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an\u00A0EntryType\u00A0object’s\u00A0uiLabelFormat\u00A0and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by\u00A0renderObjectTemplate().\n\n\n\nThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as\u00A0system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.\n\n\n\nThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.","state":0,"publishedAt":"2026-10-06T10:23:25.037+00:00","modifiedAt":"2026-10-07T03:55:21.5+00:00","affected":[{"ecosystem":"https://packagist.org","name":"craftcms/cms","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"craftcms\",\n                    \"product\": \"cms\",\n                    \"collectionURL\": \"https://packagist.org\",\n                    \"packageName\": \"craftcms/cms\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.0.0\",\n                            \"lessThan\": \"5.11.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://www.hckrt.com/hacktivity/HCKRT-PVWH7W","https://github.com/craftcms/cms/releases/tag/5.11.0","https://github.com/craftcms/cms","https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105985","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-105985","identifiers":["CVE-2026-105985"]},"retained":false,"historicalAffected":[]}],"coverage":[]}