Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Vulnerability Description
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
CVSS Information
N/A
Vulnerability Type
CWE-1336
Vulnerability Title
Craft CMS 安全漏洞
Vulnerability Description
Craft CMS是Craft CMS开源的一套内容管理系统（CMS）。 Craft CMS 5.8.21版本存在安全漏洞，该漏洞源于通过create() Twig函数结合Symfony Process小工具链进行服务器端模板注入，可能导致远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A