Craft CMS CVE-2026-115935

Requires an authenticated Craft control-panel account possessing the accessCp permission (explicitly a non-admin, low-privileged user) and network reach to the app/process-api-response-headers control-panel action. The concrete trigger is CRLF/newline injection into the X-Craft-Plugin-Licenses response header value, which Craft's .env writer persists without stripping newlines, allowing insertion of an attacker-chosen CRAFT_SECURITY_KEY; the attacker then forges a signed login redirect containing a Twig system() callback. The limiting factor is that a valid control-panel login is mandatory - this is not exploitable by fully unauthenticated internet attackers - but no admin rights, no user interaction, and no non-default configuration are needed, so any CP user with accessCp qualifies. This source is independent of the prior Twig-sandbox key-read report, so fixing one does not fix this one.

This is a genuine priority despite requiring authentication. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only low privileges, with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) - consistent with the described outcome of arbitrary OS command execution as the PHP worker. The decisive factor is the privilege model: PR:L here means any authenticated control-panel user holding only the accessCp permission (explicitly a non-admin), so the vulnerability converts a routine low-trust CP account into full server RCE, a severe privilege-escalation-to-code-execution chain. The vendor (Craft CMS) and GHSA-9hp6-3565-gvh5 confirm the mechanism and that a patch exists, and vuln.today assigns a 'this_week' decision label, indicating elevated but not emergency urgency. No CISA KEV listing and no EPSS score are provided in the input, so widespread or active exploitation is NOT established - the signal set points to a high-impact, authenticated flaw that is credible and patch-available rather than a confirmed mass-exploitation event. A public report reference from Hackrate (HCKRT-WM3VSE) exists but is not verified as working exploit code. The only notable caveat: the vendor CVSS and my assessment agree, so there is no CVSS-vs-description conflict to flag here.

An attacker who holds (or phishes/registers) a low-privileged Craft control-panel account with the accessCp permission sends a crafted request to the app/process-api-response-headers action, embedding newline characters in the X-Craft-Plugin-Licenses value to inject a CRLF-based new CRAFT_SECURITY_KEY into the .env file. Once Craft loads the attacker-known key, they forge a signed login redirect carrying a Twig system() callback, achieving OS command execution as the PHP worker. A public report reference (Hackrate HCKRT-WM3VSE) exists but is not verified as working exploit code.