What is GHSA-9fvq-jx89-q558?

GHSA-9fvq-jx89-q558 is a security advisory published by GitHub Security Advisories with High severity. The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the...

Which CVE IDs does GHSA-9fvq-jx89-q558 cover?

GHSA-9fvq-jx89-q558 covers the following CVE IDs: CVE-2026-79988. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-9fvq-jx89-q558High

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the...

Vendor

GitHub Security Advisories

Published

August 27, 2026

Last Modified

August 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-79988 →

📋 Description

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-79988
https://github.com/craftcms/cms
https://github.com/craftcms/cms/releases/tag/5.10.7
https://www.hckrt.com/hacktivity/HCKRT-8RQQ7K
https://github.com/advisories/GHSA-9fvq-jx89-q558