The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.
HIGH
Vulnerability intelligence
CVE-2026-79988
CVSS 4.08.7
SeverityHigh
Known exploitedNo
NVD references:
Primary source: NIST National Vulnerability Database