CVE-2026-72781

The critical vulnerability in CVE-2026-72781 is not a classic injection flaw — it is a sandbox design failure where marking an interface as safe inadvertently whitelisted an entire class hierarchy containing the Yii2 Component gadget chain. When Craft CMS applied the AllowedInSandbox attribute to ElementInterface, PHP's inheritance semantics carried that trust up through craft\base\Component to yii\base\Component, exposing the magic methods (__call, __get) that form a well-documented gadget chain. An authenticated user with control panel access can exploit this through Twig templates rendered within the sandbox — not by breaking out of the sandbox, but by using its allowlist to reach trusted objects that happen to be dangerous. The attack surface is broader than the CVSS suggests. In Craft's permission model, 'control panel access' encompasses content editors, authors, and potentially lower-privileged users depending on configuration. This means the exploitation path requires authentication but not necessarily administrative privileges. For defenders, the remediation in versions 5.10.7 and 4.18.3 likely scopes AllowedInSandbox to specific methods or classes rather than interface-level inheritance. Audit your codebase for other AllowedInSandbox attributes applied to interfaces — each one grants access to the full inheritance tree. The pattern to watch for: any interface marked safe that is implemented by classes extending yii\base\Component or otherwise containing magic methods. The deeper takeaway is that sandbox allowlisting in PHP frameworks requires class-level or method-level scoping, not interface-level. PHP's inheritance model makes interface-level marking inherently broad. If your framework's attribute system defaults to interface-level allowlisting, treat that as a security debt item — the feedback loop that lets developers mark interfaces safe without visible risk is exactly what enabled this vulnerability.

Reviewed through automated stages and approved by a human before publication.