EUVD-2026-56106
GHSA-cc2g-26rw-g997
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible control panel with no complexity barrier once authenticated at low privilege; pure high-confidentiality impact with no direct integrity or availability effect at the primary exploitation step.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.
AnalysisAI
Craft CMS exposes arbitrary environment variables and secrets to authenticated control panel users due to premature interpolation of ${ENV_VAR} patterns in the elementId parameter before Twig sandbox evaluation - a design flaw that bypasses the sandbox entirely because substitution occurs outside the renderer. Affected versions span both the 4.x and 5.x release lines from their respective RC1 milestones through just before 4.18.2 and 5.10.6. An attacker holding any control panel account can exfiltrate CRAFT_SECURITY_KEY and all other configured secrets via a blind, error-based extraction loop, enabling session forgery, privilege escalation, and theft of database, SMTP, API, and blob storage credentials; no public exploit or active exploitation has been identified at time of analysis.
Technical ContextAI
Craft CMS is a PHP-based content management system distributed as the composer package craftcms/cms. Starting with version 4.0.0-RC1, Craft introduced a Twig sandbox via enableTwigSandbox() to mitigate remote code execution risks by restricting what sandboxed templates can access. CWE-668 (Exposure of Resource to Wrong Sphere) is the root cause: the elementId request parameter includes a pre-processing stage that substitutes ${ENV_VAR} placeholder strings with their corresponding values from the process environment or a secrets file before the resulting string is forwarded to the Twig renderer. Because this substitution happens before Twig evaluation, the sandbox has no visibility into it and cannot block it. This is a partial regression of the fix for CVE-2026-31857, which introduced sandboxed Twig rendering but left the environment variable interpolation path unguarded and user-controlled. The outcome is that the Twig sandbox - intended as the security boundary - is bypassed at the input-preparation layer. Affected CPE: cpe:2.3:a:craftcms:cms across both 4.x and 5.x lines on all platforms.
RemediationAI
Upgrade to Craft CMS 5.10.6 (for 5.x deployments) or 4.18.2 (for 4.x deployments), the vendor-confirmed fixed versions per GitHub advisory GHSA-596p-6jv8-775v at https://github.com/craftcms/cms/security/advisories/GHSA-596p-6jv8-775v. If an immediate upgrade is not feasible, restrict control panel access to the minimum required set of trusted accounts, revoking access from all non-essential users including content editors and third-party contractors; this reduces the pool of valid attackers but does not eliminate the vulnerability. As a mandatory post-patch action, rotate all secrets that were present in the environment or secrets file during the exposure window, including CRAFT_SECURITY_KEY, database credentials, SMTP passwords, and any third-party API keys - rotating CRAFT_SECURITY_KEY will invalidate all active sessions as a side effect. Consider placing the Craft control panel behind a VPN or IP allowlist to reduce its network-accessible attack surface; note that this adds operational friction for distributed editorial teams. Do not assume that enabling the Twig sandbox alone provides protection, as this vulnerability specifically bypasses that control.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-668 – Exposure of Resource to Wrong Sphere
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today