Description (CNA)
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| craftcms / cms | affected 4.0.0 before 4.18.8; unaffected 4.18.8 |
| craftcms / cms | affected 5.0.0 before 5.11.0; unaffected 5.11.0 |
CWE
CWE-94
References
- https://github.com/craftcms/cms/security/advisories/GHSA-xmwr-88vw-5ghh
- https://www.vulncheck.com/advisories/craft-cms-before-4.18.8-and-5.11.0-authenticated-rce-via-twig-group-filter-array-callable
ADP enrichment
No English description supplied.
No references supplied.