Craft CMS sites need 5.11.0 or 4.18.8 to close Twig sandbox code flaws

Craft CMS sites need 5.11.0 or 4.18.8 to close Twig sandbox code flaws

20 October 2026: Craft CMS has disclosed nine security flaws in its Twig template sandbox and related features, four of them rated high because a logged-in user can turn them into remote code execution, and all are fixed in Craft 5.11.0 and 4.18.8. Canada's Centre for Cyber Security published alert AV26-1067 on 20 October telling administrators to update, more than six weeks after the fixed releases shipped.

Not yet independently verified. The advisories carry no CVE numbers or CVSS scores, and one record lists the 4.x range as up to and including 4.18.8 although 4.18.8 is the fixed release. We will add CVE numbers if the project assigns them. We will update this when it can be confirmed, and remove this note.

Four ways from a Twig template to server code

The high-severity advisories all reach the same place by different routes: code running on the web server under the account of someone who can edit templates, content or field settings.

• GHSA-xmwr-88vw-5ghh: the Twig group filter accepts an array callable, which lets an authenticated user call PHP methods. Craft 4 and 5.
• GHSA-qm9x-rmcj-h2rc: "behavior injection" through the Asset::getMimeType transform, which slips past the sandbox. Craft 5.
• GHSA-wr79-9v6x-5rfq: the same class of bug through uncleansed getNext, getPrev and getOwners criteria. Craft 5.
• GHSA-g48f-wc2q-4rrv: code execution through Entry Type overrides in rendered components. Craft 5.

The other five are lower rated: a sandbox allowlist bypass that discloses sensitive values, a case-sensitivity bypass of the create() blocklist, an admin-only code path through Content Block field layouts, an email verification code that stays valid for setting a password, and GraphQL mutations that do not enforce site scope on create and delete.

Which releases are safe

Line	Affected	Fixed in
Craft 5	5.0.0 up to 5.11.0	5.11.0 (latest is 5.11.5.1, 8 October)
Craft 4	4.0.0 up to 4.18.8	4.18.8 (4.18.9 followed on 17 September)

The fixed versions shipped on 1 September and the advisories were published on 5 October, so a site that has followed Craft's point releases since September is already covered. A September batch of advisories, fixed in 5.10.14 and 4.18.7, included another non-admin sandbox escape, so sites still on 5.10.x are behind on two sets of fixes.

Who should treat this as urgent

Every high-rated flaw needs a login, so the risk depends on who holds one. Agencies that give clients or freelance writers control panel accounts, and multi-site installs where editors on one site should not reach another, are the cases where an authenticated bug becomes a real one: any compromised or careless editor account becomes a route onto the server. The GraphQL scope flaw matters most to headless builds, where Craft serves content to a separate front end; our headless CMS category lists seven such platforms.

Composer-managed projects update with a version constraint change and a deploy; Craft's own updater in the control panel does the same for sites that allow it. Logs of template edits by non-developer accounts since early October are the place to look for misuse.

Related on TrustList:

• PHP fixes two critical remote code execution flaws, update now
• CERT/CC says ten Thelia 2.6 flaws are unpatched; Thelia ships 3.2.1

Sources

• Canadian Centre for Cyber Security: Craft CMS security advisory (AV26-1067), 20 October 2026
• Craft CMS security advisories on GitHub, 5 October 2026
• Craft CMS releases on GitHub (5.11.0 and 4.18.8), 1 September 2026