-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from CraftCMS's handling of the 'Title Format' field in Section configuration. This field accepts Twig templates, which are processed by renderObjectTemplate(). The exploit demonstrates attackers inject Twig code containing file operations to achieve RCE. renderObjectTemplate() is explicitly designed to evaluate Twig templates, and improper input validation in this context makes it the injection vector. The function's direct role in template evaluation and the documented exploit path justify high confidence.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| craftcms/cms | composer | <= 3.8.1 |
Ongoing coverage of React2Shell