Craft CMS Twig blocklist bypass enabling privileged code execution

#!/usr/bin/env bash
# check-cve-2026-28783.sh
# Detect likely exposure to CVE-2026-28783 in Craft CMS.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

set -u

APP_ROOT="${1:-.}"

if ! command -v php >/dev/null 2>&1; then
  echo "UNKNOWN - php not found; cannot evaluate Craft version"
  exit 2
fi

if [ ! -d "$APP_ROOT" ]; then
  echo "UNKNOWN - app root not found: $APP_ROOT"
  exit 3
fi

get_version_from_composer_lock() {
  local lock="$1/composer.lock"
  [ -f "$lock" ] || return 1
  php -r '
    $f = $argv[1];
    $j = json_decode(file_get_contents($f), true);
    if (!$j) exit(1);
    $pkgs = array_merge($j["packages"] ?? [], $j["packages-dev"] ?? []);
    foreach ($pkgs as $p) {
      if (($p["name"] ?? "") === "craftcms/cms") {
        $v = $p["version"] ?? "";
        $v = ltrim($v, "vV");
        echo $v;
        exit(0);
      }
    }
    exit(1);
  ' "$lock"
}

get_version_from_vendor() {
  local cj="$1/vendor/craftcms/cms/composer.json"
  [ -f "$cj" ] || return 1
  php -r '
    $f = $argv[1];
    $j = json_decode(file_get_contents($f), true);
    if (!$j) exit(1);
    $v = $j["version"] ?? "";
    if (!$v) exit(1);
    echo ltrim($v, "vV");
  ' "$cj"
}

get_version_from_cli() {
  if [ -f "$1/craft" ]; then
    (cd "$1" && php craft --version 2>/dev/null) | awk '{print $NF}' | sed 's/^v//'
    return 0
  fi
  return 1
}

version_compare_php() {
  # args: v1 op v2
  php -r 'exit(version_compare($argv[1], $argv[3], $argv[2]) ? 0 : 1);' "$1" "$2" "$3"
}

is_affected() {
  local v="$1"
  if version_compare_php "$v" ">=" "4.0.0-RC1" && version_compare_php "$v" "<" "4.17.0"; then
    return 0
  fi
  if version_compare_php "$v" ">=" "5.0.0-RC1" && version_compare_php "$v" "<" "5.9.0"; then
    return 0
  fi
  return 1
}

is_in_fixed_major() {
  local v="$1"
  if version_compare_php "$v" ">=" "4.17.0" && version_compare_php "$v" "<" "5.0.0"; then
    return 0
  fi
  if version_compare_php "$v" ">=" "5.9.0"; then
    return 0
  fi
  return 1
}

sandbox_enabled() {
  # Best-effort check only. Existing projects may need this explicitly enabled.
  local root="$1"
  local files=""
  [ -f "$root/config/general.php" ] && files="$files $root/config/general.php"
  if [ -d "$root/config" ]; then
    # shellcheck disable=SC2046
    files="$files $(find "$root/config" -maxdepth 2 -type f \( -name '*.php' -o -name '*.php.dist' \) 2>/dev/null)"
  fi
  [ -n "$files" ] || return 1
  grep -Eqs "enableTwigSandbox[[:space:]]*=>[[:space:]]*true|['\"]enableTwigSandbox['\"][[:space:]]*=>[[:space:]]*true" $files
}

VERSION=""
VERSION="$(get_version_from_composer_lock "$APP_ROOT" 2>/dev/null)" || true
if [ -z "$VERSION" ]; then
  VERSION="$(get_version_from_vendor "$APP_ROOT" 2>/dev/null)" || true
fi
if [ -z "$VERSION" ]; then
  VERSION="$(get_version_from_cli "$APP_ROOT" 2>/dev/null)" || true
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - unable to determine Craft CMS version from composer.lock, vendor metadata, or CLI"
  exit 2
fi

if is_affected "$VERSION"; then
  echo "VULNERABLE - Craft CMS version $VERSION is in the affected range for CVE-2026-28783"
  exit 1
fi

if is_in_fixed_major "$VERSION"; then
  if sandbox_enabled "$APP_ROOT"; then
    echo "PATCHED - Craft CMS version $VERSION is fixed and enableTwigSandbox appears enabled"
    exit 0
  else
    echo "UNKNOWN - Craft CMS version $VERSION is fixed, but enableTwigSandbox was not confirmed from local config"
    exit 2
  fi
fi

echo "PATCHED - Craft CMS version $VERSION is outside the affected major/version ranges for CVE-2026-28783"
exit 0