{"id":"CVE-2026-105985","summary":"Authenticated RCE via render-components Entry Type overrides","details":"Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.\n\n\n\nAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().\n\n\n\nThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.\n\n\n\nThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.","aliases":["GHSA-g48f-wc2q-4rrv"],"modified":"2026-10-08T02:49:18.048070520Z","published":"2026-10-06T10:23:25.037Z","database_specific":{"cna_assigner":"Hackrate","cwe_ids":["CWE-1336"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105985.json"},"references":[{"type":"WEB","url":"https://packagist.org"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105985.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/releases/tag/5.11.0"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105985"},{"type":"ADVISORY","url":"https://www.hckrt.com/hacktivity/HCKRT-PVWH7W"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/craftcms/cms","events":[{"introduced":"f6a8fb685d44e387435825e3a96809eeda4973a6"},{"fixed":"2255717bfd5cc502751601aa68bf72eea035cd47"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"5.0.0"},{"fixed":"5.11.0"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105985.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}