[HIGH] Craft CMS: Authenticated RCE through Twig sandbox escape

PKSA-d48x-nyby-nphv CVE-2026-72781 GHSA-f5wm-88jv-g5hx

Affected package: craftcms/cms

Affected version: >=4.0.0-RC1,<4.18.3|>=5.0.0-RC1,<5.10.7

Reported by:
GitHub