Serial number: AV26-1067
Date: October 20, 2026
As of October 19, 2026, Craft CMS is affected by vulnerabilities in the following product:
- Craft CMS
- Prior to 4.18.8
- Prior to 5.11.0
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
- Authenticated RCE via Twig group filter array-callable
- Twig sandbox allowlist bypass discloses sensitive values
- Authenticated RCE: Twig sandbox "on/as" behavior injection via "Asset::getMimeType" transform
- Authenticated RCE: Twig sandbox "on/as" behavior injection via uncleansed "getNext/getPrev/getOwners" criteria
- Authenticated admin RCE via Content Block field-layout JSON-string cleanse
- Craft CMS Security Advisories