Executive brief
Craft CMS, a popular content management system, contains a vulnerability that allows certain authorized users to read sensitive server files. By modifying system email templates, an attacker can trick the server into including the contents of the site's configuration files (such as the .env file) within outgoing emails. This could lead to the exposure of database passwords and security keys, potentially allowing an attacker to take full control of the administrative account.
Technical details
A sensitive file disclosure vulnerability exists in Craft CMS due to the `dataUrl()` Twig function being included in the Twig sandbox allowlist. Users with the `utility:system-messages` permission can embed this function into system email templates. The `Html::dataUrl()` helper fails to block dotfiles, allowing it to read the `.env` file located at the project root. When an email is rendered via `renderSandboxedString()`, the file content is base64-encoded and embedded in the email body. Attackers can exfiltrate the `CRAFT_SECURITY_KEY` to forge session tokens and escalate privileges to administrator. The issue is patched in versions 4.18.0 and 5.10.0.
Affected products
- Craft CMS Craft CMS >= 4.0.0-RC1, < 4.18.0; >= 5.0.0-RC1, < 5.10.0
Timeline
- 2026-06-16: disclosed: Vulnerability reported to vendor
- 2026-07-02: advisory: NVD publication date
- 2026-07-06: patched: GitHub Advisory published and reviewed