Executive brief
Craft CMS is a web content management system that allows administrators to define template content. A security flaw in versions 4 and 5 allows authenticated users with control panel access to steal sensitive environment variables and secrets (such as database credentials, API keys, and session signing keys) from the server, even when security protections are enabled. An attacker can exploit this to forge administrator sessions, escalate privileges, and gain unauthorized access to databases and external services.
Technical details
The vulnerability exists in how Craft CMS handles the elementId parameter when rendering Twig templates. The application interpolates environment variables referenced as ${ENV_VAR} strings into Twig templates before rendering, even when the Twig sandbox is enabled (intended as a mitigation against remote code execution from CVE-2026-31857). An authenticated attacker with control panel access can craft a malicious sandboxed Twig template that leverages a blind error-based exfiltration technique similar to blind SQL injection. Although the template output is not directly reflected in responses and sandboxed templates cannot use network functions for direct exfiltration, the attacker can incrementally leak any environment variable by observing error messages and template behavior across multiple requests. Leaked secrets can include CRAFT_SECURITY_KEY (for session forgery), database credentials, SMTP passwords, and API keys. The vulnerability is rooted in CWE-668 (Exposure of Resource to Wrong Sphere) and requires only low-privilege authenticated access. Patches are available in versions 5.10.6 and 4.18.2.
Affected products
- Craft CMS Craft CMS >= 4.0.0-RC1, < 4.18.2; >= 5.0.0-RC1, < 5.10.6
Timeline
- 2026-07-25: disclosed: Original advisory GHSA-596p-6jv8-775v published
- 2026-08-11: disclosed: CVE-2026-72782 published; duplicate advisory GHSA-cc2g-26rw-g997 published
- 2026-08-11: patched: Patches released in versions 5.10.6 and 4.18.2