Craft CMS authenticated environment variable leak in Twig templating

Severity: medium · CVSS 6.5 · Published 2026-08-11

Craft CMS is a web content management system that allows administrators to define template content. A security flaw in versions 4 and 5 allows authenticated users with control panel access to steal sensitive environment variables and secrets (such as database credentials, API keys, and session signing keys) from the server, even when security protections are enabled. An attacker can exploit this to forge administrator sessions, escalate privileges, and gain unauthorized access to databases and external services.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.5, published 11 August 2026.
Which products and versions are affected?
craftcms/cms (Packagist) >= 4.0.0-RC1, < 4.18.2.
Is there a fix for This vulnerability?
A patch was published on 2026-08-11: Patches released in versions 5.10.6 and 4.18.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a web application.
Am I affected?
Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in how Craft CMS handles the elementId parameter when rendering Twig templates. The application interpolates environment variables referenced as ${ENV_VAR} strings into Twig templates before rendering, even when the Twig sandbox is enabled (intended as a mitigation against remote code execution from CVE-2026-31857). An authenticated attacker with control panel access can craft a malicious sandboxed Twig template that leverages a blind error-based exfiltration technique similar to blind SQL injection. Although the template output is not directly reflected in responses and sandboxed templates cannot use network functions for direct exfiltration, the attacker can incrementally leak any environment variable by observing error messages and template behavior across multiple requests. Leaked secrets can include CRAFT_SECURITY_KEY (for session forgery), database credentials, SMTP passwords, and API keys. The vulnerability is rooted in CWE-668 (Exposure of Resource to Wrong Sphere) and requires only low-privilege authenticated access. Patches are available in versions 5.10.6 and 4.18.2.

Affected products

  • Craft CMS Craft CMS >= 4.0.0-RC1, < 4.18.2; >= 5.0.0-RC1, < 5.10.6

Timeline

  • 2026-07-25: disclosed: Original advisory GHSA-596p-6jv8-775v published
  • 2026-08-11: disclosed: CVE-2026-72782 published; duplicate advisory GHSA-cc2g-26rw-g997 published
  • 2026-08-11: patched: Patches released in versions 5.10.6 and 4.18.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.