Craft CMS CVE-2026-92592

Exploitation requires an authenticated Craft user account (Control Panel/admin rights NOT required - any non-administrator front-end account suffices) that uses password authentication WITHOUT active two-factor authentication. The target must run the DEFAULT Craft request configuration, and the PHP system() function must be callable (not disabled via disable_functions or a restrictive PHP policy). The specific abuse path is the license-shun endpoint, which signs a cookie with the same key/format used to validate signed redirect parameters; the attacker transplants that signed envelope into the login redirect parameter to trigger unsandboxed Twig rendering. Limiting factors that reduce real-world exposure: enforced/active 2FA blocks the required account state; a non-default request configuration or PHP environments with system() disabled neutralize the RCE; the requirement for a valid low-privilege account (rather than fully unauthenticated) narrows the attacker pool.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, score 8.7) describes a fully-remote, low-complexity path to arbitrary OS command execution as the web-server user by any authenticated non-administrator - Control Panel access is explicitly NOT required, which dramatically widens the eligible attacker pool (any member/editor account on a Craft site with front-end login). The technical impact is total (full RCE), and the root cause is a clean cryptographic design flaw (HMAC signature not bound to its purpose, CWE-1336: same Craft securityKey backs Yii's cookieValidationKey and signed request parameters), making it deterministic rather than probabilistic to exploit once understood. Countervailing signals lower the URGENCY somewhat: no CISA KEV listing (not confirmed actively exploited), no public POC referenced in the supplied data, and no EPSS score provided - so this reflects disclosed-but-not-yet-weaponized status. Real exploitation is also gated by three concrete non-CVSS conditions (an account using password auth WITHOUT active 2FA, the default request configuration, and PHP system() being callable), which meaningfully reduce the exploitable population on hardened deployments. Net: treat as a priority patch for any multi-user Craft install, especially those without enforced 2FA or with permissive PHP; the absence of KEV/POC lowers immediacy but not the intrinsic severity.

An attacker who holds (or registers/phishes) any low-privilege Craft user account without 2FA calls the license-shun endpoint to obtain a validly signed cookie envelope, then transplants that signed value into the login redirect parameter. Because the same key validates both, Craft accepts the signature and renders the attacker-supplied bytes as an unsandboxed Twig template, where the map filter's string callback invokes PHP system() to run OS commands as the web-server user. No public POC is referenced in the supplied data, but the mechanism is fully described and deterministic.