Executive brief
Craft CMS is a popular content management system that relies on a MySQL database to operate. When the database becomes unavailable while the web server remains running, Craft incorrectly treats this as a sign the system is not yet installed, allowing access to the installer interface. An attacker with a valid guest session cookie from before the outage can request sensitive configuration values—such as security keys, database credentials, and API keys—through this installer, exposing critical secrets that compromise the entire system.
Technical details
The vulnerability stems from insecure fail-open logic: Craft CMS interprets any database connection failure as proof that the system is uninstalled, enabling the installer actions on already-installed production systems. The install/validate-site endpoint accepts a site name parameter, passes it through Site::getName() for serialization, and expands ${VARIABLE} expressions using App::env(), exposing environment variables, PHP constants, and Craft configuration. An unauthenticated attacker requires three preconditions: a guest CSRF session cookie obtained before the database outage, a matching CSRF token, and knowledge of a predictable variable name (e.g. CRAFT_SECURITY_KEY). The attack vector is network-based but has high attack complexity because it depends on an independently occurring database failure—the vulnerability provides no mechanism to trigger it. The patch (version 5.10.13 and later) treats database errors as an indeterminate state and stops expanding environment expressions in installer input.
Affected products
- Craft CMS 5.0.0 through 5.10.12
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 5.10.13