https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T00:27:30.554975+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-250591 EUVD-2026-250591 2026-10-16T00:27:30.609419+00:00 EUVD-2026-250591 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57811 fkie_cve-2025-57811 2026-10-16T00:27:30.609483+00:00

Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.

 https://cve.radiocsirt.org/vuln/ghsa-crcq-738g-pqvc GHSA-crcq-738g-pqvc — Craft CMS Potential Remote Code Execution via Twig SSTI 2026-10-16T00:27:30.609516+00:00

Affected: Packagist: craftcms/cms

Note that users must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.

https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production

Note: This is a follow-up to [GHSA-f3cw-hg6r-chfv](https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv)

Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue.

Resources: https://github.com/craftcms/cms/pull/17612