CVE-2026-115938 in Craft CMS
Summary
by MITRE • 10/24/2026
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.
The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.
After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability in Craft CMS represents a sophisticated chain of logic flaws that allows authenticated control panel users to escalate privileges from standard user access to full remote code execution. The initial entry point lies within the element-search functionality, where any authenticated user can submit specific search conditions. These conditions are processed by an allowed column filter which delegates property lookup operations to Yii ArrayHelper rather than adhering strictly to Twig’s SecurityPolicy sandbox constraints. This architectural oversight means that repeated single-segment lookups effectively bypass the empty property and method allowlists designed to restrict template execution, creating a pathway for unauthorized code evaluation within what should be a restricted environment.
The exploitation of this flaw relies on a precise side-channel mechanism known as a character oracle. The vulnerable condition value is ultimately cast to an integer during processing, which might suggest some level of sanitization; however, the underlying Twig template logic can still return distinct values based on whether a guessed key character matches the expected secret. Specifically, if the guess for a character in GeneralConfig::securityKey is correct, the template returns author ID 1. If the guess is incorrect, it returns an impossible or non-existent ID value. This binary response pattern allows an attacker to iteratively query the system and recover the security key one character at a time through repeated requests, forming a stable remote oracle that leaks sensitive configuration data without triggering traditional error-based detection mechanisms.
Once the GeneralConfig::securityKey is recovered via this side-channel attack, the impact escalates significantly from information disclosure to full compromise. With knowledge of this secret, an attacker can compute Craft’s generic HMAC wire format offline for any given parameter set. This capability allows them to forge signed parameters such as redirect URLs that are subsequently accepted by the application because they pass integrity verification checks. These forged parameters are then passed to unsandboxed View::renderObjectTemplate() functions, which operate outside the protective boundaries of Twig’s SecurityPolicy. In this context, Twig’s string-callable form can be manipulated to invoke native PHP callables directly, bypassing all previous sandbox restrictions and enabling arbitrary code execution on the server.
The operational impact of this vulnerability is severe, as it effectively neutralizes Craft CMS’s primary defense mechanism against template injection attacks. The ability to execute arbitrary PHP code means an attacker can read sensitive files, modify database contents, or potentially achieve complete control over the underlying operating system depending on the web server's privileges and configuration. Although proof-of-concept demonstrations may use harmless functions like substr() to demonstrate capability without causing immediate destructive damage, such as transforming abcdef into cdef, the potential for malicious exploitation is unrestricted. This regression highlights a critical failure in maintaining strict separation between allowed template operations and underlying framework helper methods that possess broader execution capabilities.
Mitigation strategies must address both the immediate code flaws and the broader architectural assumptions regarding trust boundaries. Developers should ensure that all property lookups within templates are strictly mediated by Twig’s SecurityPolicy, preventing direct delegation to external helpers like Yii ArrayHelper for sensitive data access. Input validation on search conditions should be hardened to reject or sanitize any values that could trigger complex template evaluation logic outside of expected parameters. Furthermore, the reliance on a static security key for HMAC generation requires robust randomization and secure storage practices to minimize the risk of oracle-based recovery attacks. Organizations running affected versions must apply vendor-provided patches immediately and audit their control panel user permissions to ensure that only trusted administrators have access to search functionalities that interact with template rendering engines. This incident underscores the importance of rigorous code review processes when integrating third-party framework components into security-critical application logic, particularly where sandboxed environments are involved.