Is there a public PoC exploit available for EUVD-2026-41212?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41212. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for EUVD-2026-41212?

Yes, a patch is available for EUVD-2026-41212. Update the affected software to the latest version immediately.

Craft CMS EUVD-2026-41212

Q: What is the CVSS score of EUVD-2026-41212?

EUVD-2026-41212 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-55792 MEDIUM

Information Exposure (CWE-200)

2026-07-02 security-advisories@github.com

GHSA-287w-mxq6-x2cp

Information Disclosure

6.0

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible exploit via email template rendering (AV:N), low-privilege control panel permission required (PR:L), scope unchanged as impact remains within the CMS application boundary (S:U), full confidentiality loss from unrestricted .env file read (C:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 02, 2026 - 00:28 vuln.today

DescriptionCVE.org

Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover. This issue has been fixed in versions 4.18.0 and 5.10.0.

AnalysisAI

Server-side file exfiltration in Craft CMS versions 4.0.0-RC1 through 4.17.x and 5.0.0-RC1 through 5.9.x allows any control panel user granted the utility:system-messages permission to embed a dataUrl() Twig payload into system email templates, causing the server to read and base64-encode arbitrary files - including the .env file - into outbound email bodies. Exfiltration of CRAFT_SECURITY_KEY from the .env file enables an attacker to forge valid session tokens and escalate to full administrator account takeover, chaining a confidentiality breach into complete privilege escalation. No public exploit has been identified at time of analysis; patches are available in 4.18.0 and 5.10.0.

Technical ContextAI

Craft CMS uses the Twig templating engine with a sandboxed function allowlist intended to restrict what unprivileged control panel users can invoke. The dataUrl() function - designed to embed binary file contents as base64-encoded data URIs directly in HTML and email output - was included in this allowlist without restricting which filesystem paths it could target. At email render time, the PHP application calls dataUrl() server-side, reads the named file from the local filesystem, and encodes its contents into the outgoing email body, completely bypassing Craft's stated dataUrl() protection checks. This constitutes a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) flaw rooted in insufficient sandbox policy: the allowlisted function had unrestricted filesystem read access. The .env file, which in standard Craft deployments contains CRAFT_SECURITY_KEY (used to sign and verify session tokens), the database password, and third-party API credentials, is directly readable via this vector. CPE strings were not provided in the NVD data at time of analysis; affected versions are confirmed via GitHub Security Advisory GHSA-287w-mxq6-x2cp.

RemediationAI

Upgrade to Craft CMS 4.18.0 (for 4.x deployments) or 5.10.0 (for 5.x deployments), which resolve this issue by restricting or removing dataUrl() from the Twig sandbox allowlist. The upstream fix is documented in GitHub PR #18559 at https://github.com/craftcms/cms/pull/18559 and the full security advisory at https://github.com/craftcms/cms/security/advisories/GHSA-287w-mxq6-x2cp. As an immediate compensating control prior to patching, revoke the utility:system-messages permission from all non-administrator user groups - this eliminates the exploitable attack surface at the cost of restricting who can manage system email templates, which may impact content editor workflows. Additionally, if there is any possibility the permission has been misused or the deployment has been targeted, rotate CRAFT_SECURITY_KEY in the .env file immediately (which invalidates all existing sessions and any tokens forged from an exposed key), rotate the database password, and regenerate all third-party API keys stored in .env. A patched version (upstream fix via PR; no separately tagged release artifact has been independently confirmed beyond the advisory's stated fix versions) should be deployed as soon as operationally feasible.