Craft CMS Unsigned Template Injection Remote Code Execution

Craft CMS versions 5.10.0 through 5.11.1 contain a critical remote code execution vulnerability in the app/render-elements endpoint that allows non-administrator users to bypass template sandboxing. By obtaining HMAC-signed Twig templates and submitting them as login redirect parameters, attackers can trigger unsandboxed renderObjectTemplate() evaluation, leading to arbitrary OS command execution with PHP worker privileges. This vulnerability is particularly dangerous because it requires only basic control panel access—not full administrator rights—making it exploitable by low-privilege users or compromised accounts. Organizations running affected Craft CMS versions face immediate risk of complete server compromise, data exfiltration, and lateral movement within their infrastructure.

While this CVE does not map to existing MITRE ATT&CK techniques in the current framework, Casky's Claude-powered analysis would detect attack patterns associated with Execution (T1059 - Command Line Interface, T1203 - Exploitation for Client Execution) and Privilege Escalation (T1548 - Abuse Elevation Control Mechanism). Practitioners using Casky would observe findings highlighting: template injection patterns in HTTP request parameters, HMAC signature validation bypasses, and suspicious renderObjectTemplate() calls in application logs. The platform's extended reasoning would flag the progression from low-privilege authentication to OS command execution, correlating suspicious redirect parameters with backend template rendering, and identifying the PHP worker process as the execution context—enabling defenders to detect exploitation attempts before payload execution occurs.