Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-115938: Craft CMS logged-in users can steal security key
CVE-2026-115938 · published 12 days ago
Summary
Anyone with a normal control‑panel login can send a specially crafted search request that bypasses Craft’s safety checks and reveals the system’s security key. With that key they can forge signed requests that let them run code on the server. Update Craft to the latest version and apply any provided patches, or restrict access to the control panel to trusted administrators only.
What to do
- Update craftcms cms to version 5.11.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| craftcms | cms | < 5.11.2 |
Original advisory text
Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.
The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.
After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.
After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
References
- https://github.com/craftcms/cms Product
- https://github.com/craftcms/cms/releases/tag/5.11.2 Vendor Advisory
- https://www.hckrt.com/hacktivity/HCKRT-DRNL9W Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-1159... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-115938 Vendor Advisory
- https://packagist.org URL
- https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published23 Oct 2026
Updated4 Nov 2026
First seen23 Oct 2026
Sources
CVE-2026-115938 · NVD
CVE-2026-115938 · MITRE
CVE-2026-115938 · OSV
GHSA-v4q3-2g5g-wjj6 · GHSA
Track software like this
Free during beta