{"id":"CVE-2026-115938","kind":"vulnerability","aliases":["CVE-2026-115938"],"related":[],"title":"Craft CMS: control panel users can leak the security key and run PHP","description":"Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\n\n\n\nAfter recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.","summary":"Any authenticated control panel user can abuse an element-search filter, evaluated as a Twig template, to recover Craft CMS's secret security key one character at a time. With that key they can forge signed requests that reach an unsandboxed template renderer, which can invoke native PHP callables.","severity":"high","cvss":8.8,"epss":0.00682,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","package","php","self-hosted"],"not_affected_if":["auth-required","no-untrusted-cp-users"],"how_to_check":"- Check the installed Craft CMS version with `composer show craftcms/cms` and compare it against the fixed release in the sources.\n- Confirm whether any non-admin control panel users exist that could reach element search.","fix":"- Upgrade Craft CMS to the patched release listed by the vendor (version unknown from the sources).\n- Rotate `GeneralConfig::securityKey` after upgrading, since it may have been exposed.","status":"open","published_at":"2026-10-23T22:16:59+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","triaged_at":"2026-10-25T02:59:57+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T02:59:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Craft CMS to the patched release listed by the vendor (version unknown from the sources).\n- Rotate `GeneralConfig::securityKey` after upgrading, since it may have been exposed.","reach":"internet","title":"Craft CMS: control panel users can leak the security key and run PHP","impact":"high","summary":"Any authenticated control panel user can abuse an element-search filter, evaluated as a Twig template, to recover Craft CMS's secret security key one character at a time. With that key they can forge signed requests that reach an unsandboxed template renderer, which can invoke native PHP callables.","category":"package","nicknames":[],"who_cares":["craft-cms","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker recovers the security key and runs native PHP callables on the server.","analyst_note":"Find the patched Craft CMS version and the affected version range from the NVD entry or the vendor advisory.","how_to_check":"- Check the installed Craft CMS version with `composer show craftcms/cms` and compare it against the fixed release in the sources.\n- Confirm whether any non-admin control panel users exist that could reach element search.","needs_analyst":true,"not_affected_if":["auth-required","no-untrusted-cp-users"],"who_is_affected":"Sites running Craft CMS with control panel accounts that are not fully trusted, since any authenticated control panel user can exploit this. Sites where only fully trusted administrators have control panel access face much lower risk. The sources do not state which Craft versions are vulnerable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":3582,"output_tokens":581,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115938':16A,19A '-2026':15A,18A '1':154C 'abcdef':241C 'abus':34B 'accept':212C 'allow':80C,106C 'allowlist':131C 'array':179C 'arrayhelp':114C 'authent':29B,82C 'author':152C 'becom':242C 'bypass':125C 'callabl':77B,224C,230C 'callback':238C 'case':175C 'cast':138C 'cdef':243C 'charact':54B,159C,187C 'cms':2A,22B,48B,79C 'column':107C 'command':250C 'comput':197C 'condit':92C,134C 'control':3A,30B,83C 'correct':161C 'craft':1A,21B,47B,78C,104C,198C 'craft-cm':20B 'cve':14A,17A 'deleg':109C 'element':37B,90C,94C 'element-search':36B,89C 'empti':129C,178C 'endpoint':169C 'entri':171C 'evalu':40B,97C 'execut':247C 'filter':39B,108C 'first':174C 'forg':63B 'form':183C,225C 'format':203C 'generalconfig':191C 'generic':200C 'guess':157C 'harmless':236C 'hmac':201C 'host':27B 'id':153C,165C 'imposs':164C 'integ':141C 'invok':74B,227C 'json':168C 'key':10A,52B,60B,158C 'leak':7A 'lookup':111C,123C 'nativ':75B,228C 'object':102C 'observ':240C 'offlin':204C 'one':53B 'oracl':188C 'os':249C 'otherwis':166C 'outsid':115C 'packag':23B 'panel':4A,31B,84C 'paramet':206C 'pass':214C 'php':13A,24B,76B,229C 'proof':233C 'properti':110C 'property/method':130C 'protect':145C 'reach':67B 'recov':46B,190C 'redirect':209C 'regress':232C 'remot':186C 'render':71B 'renderobjecttempl':218C 'repeat':119C 'request':65B 'return':151C,170C 'run':12A 'sandbox':100C,127C 'search':38B,91C 'second':182C 'secret':50B,147C 'secur':9A,51B 'securitykey':192C 'securitypolici':118C 'segment':122C 'selector':95C 'self':26B 'self-host':25B 'sign':64B,205C 'singl':121C 'single-seg':120C 'stabl':185C 'string':223C 'string-cal':222C 'submit':87C 'substr':237C 'templat':44B,70B,103C,149C 'therefor':124C 'time':57B 'twig':43B,101C,116C,220C 'ultim':137C 'unsandbox':69B,216C 'use':234C 'user':5A,32B,85C,195C 'valu':135C 'view':217C 'vulner':133C 'whose':93C 'wire':202C 'yii':113C","nicknames":[],"mitigations":[],"who_affected":"Sites running Craft CMS with control panel accounts that are not fully trusted, since any authenticated control panel user can exploit this. Sites where only fully trusted administrators have control panel access face much lower risk. The sources do not state which Craft versions are vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T22:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"7004884b-51e2-48e8-b4a2-5ca29e80453e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115938","severity":null,"published_at":"2026-10-23T22:16:59+00:00","modified_at":"2026-10-23T22:16:59+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115938","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115938","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}