Collected research
How an obscure PHP footgun led to RCE in Craft CMS
With register_argc_argv on, PHP fills $_SERVER[argv] from the query string, and Craft CMS reads its CLI options from there without checking the SAPI, so ?--templatesPath= sets the template root from the URL. http and php stream wrappers fail Craft's file_exists guard, but ftp supports stat and templates are read with file_get_contents, so a remote Twig file loads; the filter blocklist is then dodged with sort(call_user_func) over [system, id].
Record
- Researcher
- Adam Kues
- Published by
- assetnote.io
- Topic
- Server
In the archive
Related sources
- official advisory Advisory
Tags
This page is the archive's own catalogue record. The research is the work of Adam Kues, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .