---
id: "CVE-2026-115935"
kind: "vulnerability"
aliases: ["CVE-2026-115935"]
title: "Craft CMS: control panel users can overwrite the security key and run code"
severity: "high"
cvss: 8.8
epss: 0.00682
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["craft-cms", "php", "runtime", "self-hosted"]
not_affected_if: ["no-untrusted-cp-users"]
published_at: "2026-10-23T22:16:59+00:00"
first_seen_at: "2026-10-23T23:44:51+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115935", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115935", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Craft CMS: control panel users can overwrite the security key and run code

A Craft CMS control panel user with only accessCp permission can inject newline characters through a fake X-Craft-Plugin-Licenses API header, which writes an attacker-chosen CRAFT_SECURITY_KEY into the .env file. The attacker can then forge a signed login redirect that carries a Twig system() callback, which runs commands on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115935
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115935

## From the sources

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.



A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.



This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.



This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_