CVE-2026-79988

No fix known EPSS <1%CVSS 8.7

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

Published 2026-08-27 · CVE record · OSV

Products: craftcms cms