{"id":"CVE-2026-124430","kind":"vulnerability","aliases":["CVE-2026-124430"],"related":[],"title":"Craft CMS: non-admin control panel users can run OS commands via templates","description":"Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker.","summary":"Craft CMS versions 5.10.0 through 5.11.1 let a non-administrator control panel user obtain HMAC-signed Twig templates from the app/render-elements endpoint. Those templates can be submitted as a login redirect and evaluated without the sandbox, letting an attacker execute OS commands as the PHP worker user.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","package","php","self-hosted"],"not_affected_if":["no-non-admin-control-panel-users","version-outside-5.10.0-to-5.11.1"],"how_to_check":"- Check the Craft CMS version in `composer.json` or `composer show craftcms/cms`; affected versions are 5.10.0 up to but not including 5.11.2.\n- Confirm whether the control panel has non-admin user accounts that can log in.","fix":"- Craft CMS: upgrade to `5.11.2` or later.","status":"open","published_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:49:05+00:00","updated_at":"2026-11-08T14:49:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:49:05Z","model":"claude-haiku-5-5","output":{"fix":"- Craft CMS: upgrade to `5.11.2` or later.","reach":"network","title":"Craft CMS: non-admin control panel users can run OS commands via templates","impact":"high","summary":"Craft CMS versions 5.10.0 through 5.11.1 let a non-administrator control panel user obtain HMAC-signed Twig templates from the app/render-elements endpoint. Those templates can be submitted as a login redirect and evaluated without the sandbox, letting an attacker execute OS commands as the PHP worker user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["craft-cms","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the PHP worker user on the server","analyst_note":"","how_to_check":"- Check the Craft CMS version in `composer.json` or `composer show craftcms/cms`; affected versions are 5.10.0 up to but not including 5.11.2.\n- Confirm whether the control panel has non-admin user accounts that can log in.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-5.10.0-to-5.11.1","no-non-admin-control-panel-users"],"who_is_affected":"Sites running Craft CMS 5.10.0 to 5.11.1 with the control panel exposed and at least one non-administrator user account. Sites on earlier releases or with the fixed version are not in the stated range; sites with only administrator accounts are less exposed according to the description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4639,"output_tokens":570,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124430':17A,20A '-2026':16A,19A '5.10.0':32B,81C '5.11.1':34B '5.11.2':83C 'admin':5A 'administr':39B,94C 'allow':91C 'app/render-elements':51B,107C 'attack':69B,109C 'cms':2A,23B,30B,79C 'code':87C 'command':12A,72B,128C 'contain':84C 'control':6A,40B,95C 'craft':1A,22B,29B,78C 'craft-cm':21B 'cve':15A,18A 'endpoint':52B,108C 'evalu':63B,124C 'execut':70B,88C,126C 'hmac':45B,101C 'hmac-sign':44B,100C 'host':28B 'let':35B,67B 'login':60B,118C 'non':4A,38B,93C 'non-admin':3A 'non-administr':37B,92C 'obtain':43B,99C 'os':11A,71B,127C 'packag':24B 'panel':7A,41B,96C 'paramet':120C 'php':25B,75B,131C 'redirect':61B,119C 'remot':86C 'renderobjecttempl':123C 'returnurl':115C 'run':10A 'sandbox':66B 'self':27B 'self-host':26B 'sign':46B,102C,113C 'submit':57B,111C 'templat':14A,48B,54B,104C,114C 'trigger':121C 'twig':47B,103C 'unsandbox':122C 'user':8A,42B,77B,97C 'version':31B 'via':13A,105C 'vulner':89C 'without':64B 'worker':76B,132C","nicknames":[],"mitigations":[],"who_affected":"Sites running Craft CMS 5.10.0 to 5.11.1 with the control panel exposed and at least one non-administrator user account. Sites on earlier releases or with the fixed version are not in the stated range; sites with only administrator accounts are less exposed according to the description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["craftcms","high","package","php","selfhosted"],"campaign_type":null,"search_a":"'-124430':17A,20A '-2026':16A,19A 'admin':5A 'cms':2A 'command':12A 'control':6A 'craft':1A 'cve':15A,18A 'non':4A 'non-admin':3A 'os':11A 'panel':7A 'run':10A 'templat':14A 'user':8A 'via':13A","search_b":"'5.10.0':32B '5.11.1':34B 'administr':39B 'app/render-elements':51B 'attack':69B 'cms':23B,30B 'command':72B 'control':40B 'craft':22B,29B 'craft-cm':21B 'endpoint':52B 'evalu':63B 'execut':70B 'hmac':45B 'hmac-sign':44B 'host':28B 'let':35B,67B 'login':60B 'non':38B 'non-administr':37B 'obtain':43B 'os':71B 'packag':24B 'panel':41B 'php':25B,75B 'redirect':61B 'sandbox':66B 'self':27B 'self-host':26B 'sign':46B 'submit':57B 'templat':48B,54B 'twig':47B 'user':42B,77B 'version':31B 'without':64B 'worker':76B","search_c":"'5.10.0':81C '5.11.2':83C 'administr':94C 'allow':91C 'app/render-elements':107C 'attack':109C 'cms':79C 'code':87C 'command':128C 'contain':84C 'control':95C 'craft':78C 'endpoint':108C 'evalu':124C 'execut':88C,126C 'hmac':101C 'hmac-sign':100C 'login':118C 'non':93C 'non-administr':92C 'obtain':99C 'os':127C 'panel':96C 'paramet':120C 'php':131C 'redirect':119C 'remot':86C 'renderobjecttempl':123C 'returnurl':115C 'sign':102C,113C 'submit':111C 'templat':104C,114C 'trigger':121C 'twig':103C 'unsandbox':122C 'user':97C 'via':105C 'vulner':89C 'worker':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T08:50:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124430","severity":null,"published_at":"2026-11-08T14:18:08+00:00","modified_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102044,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qj3q-j7r4-428p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T08:50:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102045,"url":"https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-rce-via-app-render-elements-signing-oracle","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}