Craft CMS EUVD-2026-104577

Requires an authenticated Craft CMS Control Panel account (PR:L) with the ability to author or influence Twig template content or field expressions that invoke the column, contains, filterByValue, index, where, or multisort filters. The flaw is reachable only through these specific array filters, which pass caller-supplied keys to ArrayHelper::getValue() without checking the Twig sandbox security policy; it does not affect sites where untrusted users cannot author Twig or supply filter keys. The key limiting factors: authentication is mandatory (no unauthenticated path), and real-world severity scales with how broadly Control Panel/author access is granted - single-admin sites face far less exposure than multi-tenant or large editorial deployments.

This is a genuine but bounded risk, best characterized as authenticated information disclosure rather than a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: network-reachable Control Panel, low attack complexity, and crucially PR:L - exploitation requires an already-authenticated Control Panel user, which is the single most important mitigating factor. Impact is confidentiality-only (VC:H, no integrity or availability impact), matching CWE-200 and the disclosure of securityKey, database credentials, and auth tokens. However, the disclosed secrets are high-value: leaking Craft's securityKey and database credentials can enable further compromise (forged tokens, direct DB access), so the second-order impact may exceed the first-order confidentiality rating. No CISA KEV listing and no public POC were provided, and EPSS is not supplied; there is no evidence of active exploitation, so this is not a widespread-scan priority. The signals do not conflict - all point to a real-but-authenticated flaw. Net: prioritize patching for any Craft deployment where Control Panel accounts are shared, loosely provisioned, or exposed to lower-trust users, but it is not a pre-auth internet-facing crisis.

A low-privileged but authenticated Craft CMS Control Panel user (e.g. a content editor) crafts a Twig template or field expression that invokes one of the affected array filters (column, contains, filterByValue, index, where, or multisort) with a dot-path key such as a traversal into the craft global. Because ArrayHelper::getValue() resolves the key without consulting the Twig sandbox security policy, the user reads back the site securityKey, database credentials, and auth tokens that the sandbox was meant to block. No public exploit code was identified at time of analysis, but the technique is straightforward to reproduce from the advisory description.