CVE-2023-29689: PyroCMS remote code execution vulnerability

The vulnerability stems from improper handling of user input in template rendering. PyroCMS uses Twig for templating, and the critical RCE occurs when unvalidated user input is passed to Twig's render() function. This allows attackers to inject Twig template syntax (e.g., {{ malicious_code }}) that executes arbitrary PHP code. While the exact controller/file isn't specified in public disclosures, the root cause lies in Twig's Environment::render method being called with attacker-controlled input, a common SSTI pattern in PHP applications. The high confidence comes from the vulnerability's classification as SSTI leading to RCE, which directly implicates template rendering functions.