Craft CMS EUVD-2026-81293

Requires an authenticated Craft CMS control-panel account with edit rights on at least one element type (PR:L) - not anonymous or default-public. The core enabling conditions are two implementation flaws present in 5.10.0-5.10.12: the getPostedRedirectUrl() → renderObjectTemplate() redirect sink is unsandboxed, and Cp::elementLabelHtml() acts as a self-signing oracle that lets a low-privilege user obtain a valid HMAC token over arbitrary Twig. Because Craft/Yii tokens are not bound to a specific parameter name, a token signed for returnUrl can be replayed as the redirect POST parameter. No user interaction is required. Exploitation is limited to instances running the affected versions that grant the attacker a CP account with any element-edit permission; upgrading to 5.10.13 removes both the unsandboxed sink and the signing oracle.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with full VC:H/VI:H/VA:H impact - consistent with the description's claim of arbitrary PHP execution and full server compromise. The one meaningful barrier is PR:L: the attacker must already hold an authenticated control-panel account with edit rights on at least one element type, which contains blast radius to environments that provision such accounts. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - the risk is derived from the technical severity and the fact that this is an incomplete fix for a prior CVE (CVE-2026-55794), meaning the sink and the attack class were already publicly documented. That prior-disclosure context materially raises the practical likelihood that a working exploit is developed, even though none is confirmed today. No signals are conflicting; the main data gap is the absence of exploitation-probability telemetry (EPSS) and any POC confirmation.

An attacker with a low-privilege Craft CMS control-panel account (edit rights on any single element type) abuses the self-signing oracle added in Cp::elementLabelHtml() to mint a valid Yii HMAC token over attacker-controlled Twig supplied as the returnUrl parameter. Because Craft/Yii tokens are not bound to a parameter name, the attacker replays that signed value as the redirect POST parameter, which flows into the unsandboxed getPostedRedirectUrl() → renderObjectTemplate() sink, achieving server-side template injection that executes arbitrary PHP. No public POC is referenced, but the flaw is a documented incomplete fix for CVE-2026-55794.