Craft CMS EUVD-2026-109206

Requires a valid authenticated Craft control panel account of any privilege level (PR:L) - exploitation is not anonymous. No non-default configuration is needed: the element-search condition feature, its allowed 'column' filter delegating to Yii ArrayHelper, and the JSON element-index endpoint are standard control panel functionality, so default installations in the vulnerable ranges (4.0.0 to <4.18.9 and 5.0.0 to <5.11.2) are affected. The only hard limiter is the authentication requirement; the oracle and subsequent HMAC forgery require no user interaction and no special platform or deployment mode. Patching to 4.18.9 or 5.11.2 is the stated fix.

This is a genuine high-priority issue rather than a CVSS-inflated one, though the authentication prerequisite tempers it. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, score 8.7) describes a network-reachable, low-complexity attack that achieves full confidentiality, integrity and availability impact - effective remote code execution as the web server user. The decisive limiter is PR:L: the attacker must already hold a valid control panel account, so this is not anonymous internet exploitation but rather a privilege-escalation/sandbox-escape path available to any logged-in CP user (including low-trust editors). No EPSS score was provided in the input, and the vulnerability is NOT listed in CISA KEV, so there is no evidence of widespread active exploitation; the vuln.today decision label is 'this_week', indicating elevated but not emergency urgency. A public PoC reference exists (the vendor advisory describes a working regression proof using a harmless substr() callback and the Hackrate hacktivity writeup), but it is not verified as a packaged, OS-command-executing exploit - the advisory explicitly notes the proof does not run an OS command. Net: treat as a prompt-patch item for any Craft CMS deployment where untrusted or numerous users have control panel access; the barrier is account access, not configuration.

A low-privilege but authenticated Craft control panel user submits an element-search condition whose selector is evaluated as a sandboxed Twig object template; by chaining single-segment column lookups that delegate to Yii ArrayHelper outside Twig's SecurityPolicy, they build a remote character oracle (author ID 1 vs. empty JSON array) to exfiltrate GeneralConfig::securityKey one character at a time. With the key recovered offline, the attacker forges Craft's HMAC-signed parameters (e.g. redirect) that reach the unsandboxed View::renderObjectTemplate(), invoking native PHP callables as the web server user. A public PoC reference exists demonstrating the sandbox escape with substr(); it is not verified as a working OS-command exploit.