Craft CMS security advisory (AV26-1067)

Serial number: AV26-1067Date: October 20, 2026 As of October 19, 2026, Craft CMS is affected by vulnerabilities in the following product: Craft CMS Prior to 4.18.8 Prior to 5.11.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Authenticated RCE via Twig group filter array-callable Twig sandbox allowlist bypass discloses sensitive values Authenticated RCE: Twig sandbox "on/as" behavior injection via "Asset::getMimeType" transform Authenticated RCE: Twig sandbox "on/as" behavior injection via uncleansed "getNext/getPrev/getOwners" criteria Authenticated admin RCE via Content Block field-layout JSON-string cleanse Craft CMS Security Advisories