CVE-2026-124430 · Package
NO FIX YET · SEE WHAT TO DO
Craft CMS versions 5.10.0 through 5.11.1 let a non-administrator control panel user obtain HMAC-signed Twig templates from the app/render-elements endpoint. Those templates can be submitted as a login redirect and evaluated without the sandbox, letting an attacker execute OS commands as the PHP worker user.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Craft CMS 5.10.0 to 5.11.1 with the control panel exposed and at least one non-administrator user account. Sites on earlier releases or with the fixed version are not in the stated range; sites with only administrator accounts are less exposed according to the description.
Not affected if no-non-admin-control-panel-users, version-outside-5.10.0-to-5.11.1
Who cares craft-cms, php, self-hosted
composer.json or composer show craftcms/cms; affected versions are 5.10.0 up to but not including 5.11.2.5.11.2 or later.Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.