Executive brief
Craft CMS, a popular content management system, contains a vulnerability that allows authorized users to access sensitive system secrets. By exploiting a flaw in how the system handles template parameters, an attacker can bypass security sandboxes to extract environment variables, such as database credentials or security keys. This could lead to full administrative takeover or unauthorized access to connected services like email and cloud storage.
Technical details
A vulnerability in Craft CMS exists where environment variables are interpolated into Twig templates before they are rendered, even when the Twig sandbox is enabled. Specifically, the 'elementId' request parameter supports a syntax (${ENV_VAR}) that replaces the string with the corresponding secret from the environment or secrets file. While the resulting value is not directly reflected in the HTTP response, an authenticated attacker with control panel access can use a blind error-based exfiltration technique (similar to blind SQL injection) to reconstruct the secret character by character. This bypasses the protections intended by the Twig sandbox, potentially allowing attackers to obtain the CRAFT_SECURITY_KEY or database credentials. The issue is fixed in versions 4.18.2 and 5.10.6.
Affected products
- Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.18.2; >= 5.0.0-RC1, < 5.10.6
Timeline
- 2026-06-16: patched: Versions 4.18.2 and 5.10.6 released
- 2026-07-25: disclosed
- 2026-08-06: advisory