module

Craft CMS Twig Template Injection RCE via FTP Templates Path

Disclosed
Dec 19, 2024

Description

This module exploits a Twig template injection vulnerability in Craft CMS by abusing the --templatesPath argument.
The vulnerability allows arbitrary template loading via FTP, leading to Remote Code Execution (RCE).
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.