AIKIDO-2026-609326

TL;DR

Craft CMS's group Twig filter accepts either a string property path or a PHP callable as its arrow argument. On the callable branch the filter invoked the callable directly without calling Twig's CoreExtension::checkArrow(), which is the check that requires a callable to be a Closure when the environment is sandboxed. A sandboxed template could therefore pass a non-Closure callable such as an arbitrary PHP function name to |group and have it invoked, escaping the sandbox and achieving remote code execution in a context meant to be restricted to a safe subset of Twig. The fix adds the checkArrow() call on the callable branch; the string branch was already safe because strings are always interpreted as nested field paths.